Privacy Policy

Preamble

This Privacy Policy (the "Policy") establishes the procedure and terms for processing, storing, and protecting the personal data of Users of the AIDIA platform (the "Platform"). It has been developed in accordance with the Constitution of the Republic of Kazakhstan, the Civil Code of the Republic of Kazakhstan, Law of the Republic of Kazakhstan No. 94-V of May 21, 2013 "On Personal Data and Its Protection" (the "Personal Data Law"), and other regulatory legal acts of the Republic of Kazakhstan in the field of personal data.

This Policy is an integral annex to the Platform's Public Offer (User Agreement). Use of the Platform constitutes the User's unconditional consent to the terms of this Policy.

1. Terms and definitions

1.1. Personal data — information relating to an identified data subject or a data subject identifiable on the basis of such information, recorded on an electronic, paper, and/or other tangible medium.

1.2. Personal data subject — the natural person to whom the personal data relates (the Platform User).

1.3. Owner and/or Operator — AIDIA TECH LLP, BIN 201040000717, which determines the purposes and procedure of personal data processing and bears responsibility for compliance with the requirements of the legislation of the Republic of Kazakhstan in this field (the "Operator").

1.4. Collection of personal data — actions aimed at obtaining personal data.

1.5. Processing of personal data — actions to collect, process, and protect personal data, performed with or without the use of automation, including accumulation, storage, modification, supplementation, use, distribution, depersonalization, blocking, and destruction of personal data.

1.6. Subject's consent — the personal data subject's expression of will, made by means of an electronic digital signature, in writing, or in another manner allowing the fact of its receipt to be confirmed, to the processing of their personal data.

2. General provisions

2.1. The operator of the personal data processed within the Platform is AIDIA TECH LLP, BIN 201040000717, located at 104 Zhangeldin St., Almaty.

2.2. This Policy applies to all personal data that the Operator receives from the personal data subject (User) in the course of registration and use of the Platform, as well as in the course of payment for the Services and support requests.

2.3. Personal data is processed on the basis of the principles of lawfulness, limitation of processing to specific, predetermined, and legitimate purposes, and conformity of the volume and nature of the processed data to the declared purposes of processing.

3. Purposes of collecting and processing personal data

The User's personal data is collected and processed by the Operator for the following purposes:

3.1. registration and identification of the User in the Platform's Personal Account;

3.2. conclusion and performance of the contract (the accepted Public Offer) for the provision of AI model access services;

3.3. settlements with the User, including in cooperation with the Payment Organization PayLink.kz LLP for the processing of payments for purchased Tokens;

3.4. provision of technical support, consideration of the User's requests, claims, and inquiries;

3.5. sending the User informational and service messages related to the use of the Platform, and, subject to separate consent, promotional messages;

3.6. ensuring the information security of the Platform, preventing fraudulent actions and unauthorized access;

3.7. performance of the obligations imposed on the Operator by the legislation of the Republic of Kazakhstan, including in the field of accounting, taxation, and anti-money laundering.

4. Categories of personal data processed

4.1. surname, first name, patronymic (if any);

4.2. e-mail address;

4.3. contact phone number;

4.4. Personal Account authorization data (login, password in hashed form);

4.5. information on Token Balance operations (top-up and debit history, transaction numbers);

4.6. technical data (IP address, cookies, information about the device and browser used, Platform access logs);

4.7. other data voluntarily provided by the User when contacting the Platform's support service.

4.8. The Operator does not collect, process, or store Users' full bank payment card details (card number, expiry date, CVV/CVC code). Payment details are processed exclusively by the Payment Organization PayLink.kz LLP in accordance with its own security policies.

5. Legal grounds for processing personal data

5.1. the consent of the personal data subject, expressed, among other things, through Acceptance of the Public Offer and/or this Policy;

5.2. the need to perform a contract to which the personal data subject is a party, or to take measures at the request of the personal data subject prior to the conclusion of the contract;

5.3. the need to perform the obligations imposed on the Operator by the legislation of the Republic of Kazakhstan.

6. Procedure for collecting, processing, and storing personal data

6.1. Personal data is collected directly from the personal data subject upon registration in the Personal Account, making payments, and contacting the Platform's support service.

6.2. Personal data is processed with and without the use of automation and includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction of personal data.

6.3. In accordance with paragraph 2 of Article 12 of the Personal Data Law, Users' personal data is stored in a database physically located in the Republic of Kazakhstan, on the servers of Hoster.KZ Company LLP located in the Republic of Kazakhstan.

6.4. The retention period of personal data is determined by the period necessary to achieve the purposes of its collection and processing specified in Section 3 of this Policy, as well as by the periods established by the legislation of the Republic of Kazakhstan (including in the field of accounting and taxation with respect to data on payments made), unless otherwise provided by the legislation of the Republic of Kazakhstan.

6.5. Upon achievement of the processing purposes or in the event the personal data subject withdraws consent, the personal data is subject to destruction or depersonalization, except where the legislation of the Republic of Kazakhstan requires its further storage.

7. Transfer of personal data to third parties and cross-border transfer

7.1. The Operator may transfer the User's personal data to the Payment Organization PayLink.kz LLP solely to the extent necessary for payment processing, as well as to other third parties engaged for the performance of obligations to the User (in particular, hosting infrastructure and technical support providers), provided that such parties ensure the level of personal data protection required by the legislation of the Republic of Kazakhstan.

7.2. The User's identification and account personal data (surname, first name, patronymic, e-mail address, phone number, authorization data, information on the Token Balance and payments made) is processed and stored by the Operator exclusively on servers physically located in the Republic of Kazakhstan, in accordance with Section 6 of this Policy, and is not subject to cross-border transfer.

7.3. For the processing of the User's request (prompt) by certain AI models, computation and processing of depersonalized requests may be carried out using the secure server infrastructures of partners located outside the Republic of Kazakhstan. The Platform guarantees that the transferred data set undergoes preliminary filtering, contains no personal information, and is transmitted over secure cryptographic protocols.

7.4. Before sending a request to a Foreign infrastructure, the Operator applies technical depersonalization measures to the transferred information that make it impossible to directly or indirectly attribute it to a specific personal data subject without additional information, which is stored exclusively by the Operator in the Republic of Kazakhstan and is not provided to the Foreign infrastructure providers, namely: assigning the request a temporary technical identifier instead of the User's account identifier; excluding from the content sent to the external API the fields containing full name, e-mail, phone number, payment data, and other direct identifiers; routing the request through the Operator's server infrastructure without disclosing the User's IP address and device data to the Foreign infrastructure.

7.5. Provided the measures specified in clause 7.4 of this Section are actually and properly implemented, the information sent to the Foreign infrastructure does not constitute personal data within the meaning of Article 1 of the Personal Data Law, since it does not allow its recipient to directly or indirectly identify a specific personal data subject. Accordingly, the legal regime of cross-border transfer of personal data provided for by Article 16 of the Personal Data Law does not apply to these relations.

7.6. The User is warned and understands that the text of the request (prompt) is composed by the User independently and at the User's own discretion, and therefore the Operator is unable to control or prevent the User from including in the request personal data (including the User's own or third parties'), legally protected secrets, or other confidential information.

7.7. The Platform strongly recommends that the User not include personal data or other confidential information about themselves or third parties in the text of requests (prompts) or in uploaded files. If the User independently includes such information in a request sent to the Foreign infrastructure, the transfer is made at the User's own volition and in the User's own interest; familiarization with this clause and subsequent use of the relevant AI model is deemed the User's consent to such transfer with respect to the content of their own request. The Operator is not liable for the consequences of the User including such information in a request.

8. Rights of the personal data subject

The personal data subject has the right to:

8.1. receive information concerning the processing of their personal data, except in cases provided for by the legislation of the Republic of Kazakhstan;

8.2. demand the clarification, blocking, or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the declared purpose of processing;

8.3. withdraw previously given consent to the processing of personal data;

8.4. appeal against the Operator's actions (inaction) in the manner provided for by the legislation of the Republic of Kazakhstan.

9. Personal data security measures

9.1. The Operator takes the necessary organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, or distribution, as well as from other unlawful actions of third parties, including: encryption protocols for data transmission (SSL/TLS); segregation of access rights of employees and contractors to information systems containing personal data; data backup; logging and monitoring of actions in the Platform's information systems.

9.2. Access to personal data is granted exclusively to the Operator's employees and engaged persons who need it to perform their employment (contractual) functions and who have undertaken confidentiality obligations.

10. Cookies and similar technologies

10.1. The Platform uses cookies and similar technologies to ensure the correct functioning of the Platform, analyze user activity, and improve the quality of the Services provided.

10.2. The User may independently restrict or disable the use of cookies in the settings of their browser, in which case certain functions of the Platform may become unavailable.

11. Requests of personal data subjects

11.1. On matters related to the processing of personal data, the personal data subject may contact the Operator at the e-mail address admin@aidia.kz.

12. Amendments to the Policy

12.1. The Operator may amend this Policy. The current version of the Policy is permanently published on the Platform at aidia.kz and is available for review by any person.

13. Final provisions

13.1. This Policy is an integral part of the Platform's Public Offer (User Agreement).

13.2. In all matters not regulated by this Policy, the Parties are governed by the legislation of the Republic of Kazakhstan on personal data and its protection.