Privacy Policy

1. General provisions

1.1. This personal data processing policy has been drawn up in accordance with the requirements of the Constitution of the Republic of Kazakhstan, the Civil Code of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V “On Personal Data and Its Protection”, and other regulatory legal acts of the Republic of Kazakhstan, and defines the position and intentions of the Limited Liability Partnership “Courstore”, BIN 220340007855 (hereinafter — the Operator) in the field of processing and protection of personal data, for the purpose of observing and protecting the rights and freedoms of every person and, in particular, the right to inviolability of private life, personal and family secrets, and the protection of one’s honour and good name.

1.2. The Operator sets, as its most important goal and as a condition for carrying out its activities, the observance of the rights and freedoms of the individual and the citizen when processing their personal data, including the protection of the rights to inviolability of private life and to personal and family secrets.

1.3. This policy of the Operator with respect to the processing of personal data (hereinafter — the Policy) applies to all information that the Operator may obtain about visitors of the website https://courstore.com, as well as its domains and subdomains.

1.4. This document is intended to communicate to personal data subjects the position and intentions of the Operator in the field of processing and protection of personal data.

1.5. The purposes of the Policy are to define the processing and to ensure the security of personal data.

1.6. The Policy is a publicly available document.

2. Basic concepts used in the Policy

2.1. Automated processing of personal data — the processing of personal data by means of computer technology;

2.2. Blocking of personal data — the temporary suspension of the processing of personal data (except where processing is necessary to clarify the personal data);

2.3. Website — the totality of graphic and information materials, as well as computer programs and databases, ensuring their availability on the Internet at the network address https://courstore.com, as well as on all domains and subdomains used by the Operator and the schools (authors) for the functioning of the Service;

2.4. Personal data information system — the totality of personal data contained in databases and the information technologies and technical means that ensure their processing;

2.5. Anonymisation of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine that personal data belong to a specific User or another personal data subject;

2.6. Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation means with personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion, and destruction of personal data;

2.7. Operator — a legal entity that, independently or jointly with other persons, organises and (or) carries out the processing of personal data, and also determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with the personal data;

2.8. Personal data — any information relating directly or indirectly to a specific or identifiable User of the website https://courstore.com, as well as its domains and subdomains;

2.9. User — any visitor of the website https://courstore.com, as well as its domains and subdomains;

2.10. Provision of personal data — actions aimed at disclosing personal data to a specific person or to a specific group of persons;

2.11. Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data known to an unlimited group of persons, including publishing personal data in the mass media, posting it on information and telecommunications networks, or providing access to personal data by any other means;

2.12. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, or to a foreign natural or foreign legal person;

2.13. Destruction of personal data — any actions as a result of which personal data are irretrievably destroyed with the impossibility of any further restoration of the content of the personal data in the personal data information system and (or) the material carriers of the personal data are destroyed.

2.14. Biometric personal data — personal data that characterise the physiological and biological features of a personal data subject and on the basis of which their identity can be established.

2.15. Online course — information materials in the form of a systematised course, comprising video and audio files, textual information and (or) information presented in another form, developed by an author or, on their instructions, by third parties, and placed in the Service, access to which may be obtained by any User who has fulfilled the terms of the User Agreement.

2.16. Service — a hardware and software complex (the “COURSTORE” information platform and online-course builder) that allows authors to place, and Users to view, Online courses placed in the said complex, provided that they accept the User Agreement. Access to the Service is possible through the Operator’s website.

2.17. Online course not placed on the Service — information materials in the form of a systematised course, comprising video and audio files, textual information and (or) information presented in another form, developed by an author or, on their instructions, by third parties, and placed on third-party resources (websites/platforms). With respect to such Online courses, the Operator carries out solely the activity of receiving payment for the Online course and the subsequent transfer of the payment to the author or rights holder of the Online course; accordingly, the processing of personal data is carried out within the framework of this activity. In this case, the provision of access to the Online course and its delivery are carried out directly by the author or rights holder of the Online course.

2.18. Third-party Service — a software product, platform or service of a third party that the User, at the User’s own discretion, connects to the Service or uses together with it, including artificial intelligence services (including ChatGPT by OpenAI and Claude by Anthropic), messengers, and payment, advertising and analytics platforms.

3. Principles and conditions of personal data processing

3.1. When processing personal data, the Operator adheres to the following principles:

3.1.1. The processing of personal data is carried out on a lawful and fair basis.

3.1.2. Personal data are not disclosed to third parties and are not disseminated without the consent of the personal data subject, except in cases provided for by the applicable legislation of the Republic of Kazakhstan.

3.1.3. Determination of specific lawful purposes before the start of processing (including collection) of personal data.

3.1.4. Only such personal data are collected as are necessary and sufficient for the Operator.

3.1.5. The merging of databases containing personal data whose processing is carried out for purposes incompatible with one another is not permitted.

3.1.6. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes.

3.1.7. When processing personal data, the accuracy of the personal data, their sufficiency and, where necessary, their relevance to the purposes of processing must be ensured. The Operator must take, or ensure the taking of, the necessary measures to delete or clarify incomplete or inaccurate personal data.

3.1.8. The personal data being processed are subject to destruction or anonymisation once the purposes of processing have been achieved or in the event that the need to achieve those purposes is lost, unless otherwise provided by the applicable legislation of the Republic of Kazakhstan.

3.2. The Operator does not process personal data concerning racial or national origin, political views, religious, philosophical or other beliefs, intimate life, or membership in public associations, including in trade unions.

4. The Operator may process the following personal data of the User

4.1. Surname, first name, patronymic;

4.2. Email address;

4.3. Telephone numbers;

4.4. Year, month, date and place of birth;

4.5. Photographs;

4.6. The website also collects and processes anonymised data about Visitors using Internet statistics services.

4.8. The data listed above are hereinafter referred to in the text of the Policy by the general term Personal data.

5. Purposes of personal data processing

5.1. The purpose of processing the User’s personal data is to provide the User with access to the services, information and/or materials contained on the website, as well as within the framework of the activity of transferring payment for an Online course to the author or rights holder.

5.2. The Operator also has the right to send the User notices and messages about new products and services, special offers and various events, as well as advertising mailings. Should the User not wish to participate in receiving messages and mailings, including advertising ones, the User has the right to decline to receive messages. To decline to receive email messages, the User must use the “unsubscribe” function contained in the relevant messages. To decline to receive SMS messages, the User must use the corresponding function in the settings of their personal account on the Website.

5.3. The anonymised data of Users collected using Internet statistics services serve to collect information about Users’ actions on the website and to improve the quality of the website and its content.

5.4. The Operator processes personal data to the extent necessary for the operation of the functions that the User connects and uses on the User’s own initiative, including integration with Third-party Services. The Operator does not sell personal data and does not use it to train artificial intelligence models.

6. Legal grounds for personal data processing

The Operator processes personal data only with the consent of the User given by any means not contrary to the requirements of the legislation of the Republic of Kazakhstan, including but not limited to:

6.1. by the User completing and/or submitting an application to accede to the Agreement for the provision of services granting electronic access to the COURSTORE service located on the website https://courstore.com, as well as its domains and subdomains.

6.2. by placing the relevant marks in specially designated fields of the Operator’s website, by performing actions on the Operator’s website or in the Operator’s hardware and software complexes that are designated as actions expressing the granting of consent (for example, continued use).

7. Procedure for collecting, storing, transferring and other types of processing of personal data

The security of the personal data processed by the Operator is ensured through the implementation of the legal, organisational and technical measures necessary for the full compliance with the requirements of the applicable legislation in the field of personal data protection.

7.1. The Operator ensures the safekeeping of personal data and takes all possible measures to prevent access to personal data by unauthorised persons.

7.2. In order to ensure the full functioning of the Service, the Operator provides Users’ personal data to the authors of Online courses placed on the Service. In doing so, the authors of Online courses undertake to use Users’ personal data solely in accordance with this Policy.

7.2.1. For the purposes of evaluating the effectiveness of advertising campaigns, measuring conversion and improving the operation of the Service, the Operator transfers a limited amount of data to web analytics services and advertising platforms, including Meta Platforms Inc., Google LLC and LLC “YANDEX”. The data transferred comprises technical information about the visit to the Service (pages viewed, referral source, device type, cookie identifiers), as well as the User’s identifiers — telephone number and email address — solely in the form of an irreversible cryptographic hash produced by the SHA-256 algorithm; the original values of such identifiers are not transferred. The transfer is carried out on the basis of the consent given by the User when accepting this Policy upon registration with the Service or when submitting a feedback form.

7.2.2. Where the User connects a Third-party Service, data is transferred at the initiative and on the instruction of the User, to the extent determined by the User’s request, and only within the data of the User’s own account (school). The processing of data by a Third-party Service is carried out in accordance with the rules and the privacy policy of that service; the Operator does not determine the purposes and means of such processing and is not responsible for the actions of the Third-party Service. The User may disconnect a Third-party Service at any time, whereupon the transfer of data ceases.

7.2.3. The author of an Online course who gains access to the personal data of learners is an independent owner and (or) operator of such data and independently ensures the lawfulness of its processing, including the existence of the consents of personal data subjects to its transfer, including cross-border transfer, where Third-party Services are used. The author bears responsibility for violations committed by the author of the Online course. The Operator provides the author with technical means and does not control the content of the author’s requests to Third-party Services.

7.2.4. When transferring data to artificial intelligence Third-party Services, the Service transfers information about learners in the minimum necessary volume and in an abbreviated (masked) form: the first name and the first letter of the surname, and a partially hidden telephone number and email address. The full contact details of learners are not transferred by the Service to such services and are available to the author only in the personal account. Information that the author enters into a Third-party Service independently is transferred at the author’s initiative and under the author’s responsibility in accordance with clause 7.2.3.

7.3. The User’s personal data will never, under any circumstances, be transferred to third parties, except in the cases specified in clauses 7.2–7.2.4 of this Policy and the cases provided for by the legislation of the Republic of Kazakhstan.

7.4. Should inaccuracies in the personal data be identified, the User may update them independently by sending the Operator a notice to the Operator’s email address infapocbpwouwhrwrsbytornvecvs.com marked “Updating of personal data”.

7.5. Personal data is processed until the purposes of processing are achieved, the Agreement ceases to be in force or the personal data subject withdraws consent, but not longer than the periods established by the legislation of the Republic of Kazakhstan. Technical security logs are retained for no longer than 12 (twelve) months. The User may at any time withdraw their consent to the processing of personal data by sending the Operator a notice by email to the Operator’s email address infapocbpwouwhrwrsbytornvecvs.com marked “Withdrawal of consent to the processing of personal data”.

7.6. The database containing personal data is located on the territory of the Republic of Kazakhstan in accordance with the requirements of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”.

8. Cross-border transfer of personal data

8.1. Before carrying out a cross-border transfer of personal data, the Operator is obliged to make certain that the foreign state to whose territory the transfer of personal data is intended ensures reliable protection of the rights of personal data subjects.

8.2. A cross-border transfer of personal data to the territory of foreign states that do not meet the above requirements may be carried out only where there is written consent of the personal data subject to the cross-border transfer of their personal data and/or for the performance of an Agreement to which the personal data subject is a Party.

8.3. Cross-border transfer of personal data when Third-party Services (clauses 7.2.1–7.2.4) are used, the servers of which may be located outside the Republic of Kazakhstan, including in the United States of America, is carried out on the basis of the User’s consent, expressed by accepting this Policy and (or) by the act of connecting the relevant Third-party Service, and also for the performance of an Agreement to which the User is a Party.

9. Final provisions

9.1. The User may obtain any clarifications on questions of interest concerning the processing of their personal data by contacting the Operator by email at infapocbpwouwhrwrsbytornvecvs.com.

9.2. This document will reflect any changes to the Operator’s personal data processing policy. The Policy is valid indefinitely until it is replaced by a new version.

9.3. The current version of the Policy is freely available on the Internet at https://courstore.com/en/privacy.

10. Use of YouTube API Services

10.1. We use YouTube API Services to publish and manage educational videos on the official Courstore YouTube channel. This tool is used only by Courstore staff for our own channel; we do not request access to users' YouTube accounts and do not collect, store or share their YouTube data. We store only the access token for our own channel and the IDs of the videos we upload.

10.2. By using Courstore content on YouTube, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's handling of data is governed by the Google Privacy Policy (https://policies.google.com/privacy).

10.3. You can revoke an application's access to your Google account at https://security.google.com/settings/security/permissions.

10.4. Upon request to infapocbpwouwhrwrsbytornvecvs.com, we delete stored data obtained through YouTube API Services within 7 days.