PERSONAL DATA PROCESSING POLICY

1. DEFINITIONS AND TERMS

1.1. For the purposes of this document, the terms below have the following meanings:

“Website” means the collection of information, graphic elements, design and other materials owned by the Company and available on the Internet at legacydance.kz, including all sections, pages, the personal account (the “Account”) and functional features.

“Services” means the provision of access to in-person dance classes and other related services described on the Website.

“Student” means an individual, including a minor, to whom the Services are provided and whose personal data are processed by the Company, including on the basis of consent given by their legal representative.

“User” means an individual of full legal capacity aged 18 or over who uses the Website, registers on it, submits applications or otherwise interacts with its features: either the Student, if aged 18 or over, or a parent or legal representative acting on behalf of and in the interests of a minor Student.

“Personal data” means any information relating to an individual identified directly or indirectly, recorded on electronic, paper and/or other physical media, together with other information defined by the laws of the Republic of Kazakhstan.

“Special categories of personal data” means information about the Student’s health and other data classified as special categories under the laws of the Republic of Kazakhstan, processed by the Company with the User’s separate, explicit consent.

“Processing of personal data” means any action or set of actions performed on personal data, with or without automated means, including collection, receipt, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction of personal data.

1.2. This Policy may use terms and definitions not listed in Clause 1.1. In that case, they are interpreted in accordance with the text of the Policy or the laws of the Republic of Kazakhstan.

2. SCOPE

2.1. This Policy sets out the procedure, conditions and principles for processing the personal data of Users and Students, the rights of personal data subjects and the Company’s obligations, as well as the personal data protection measures applied by the Company.

2.2. The Policy applies to all personal data that the Company receives from Users in the course of using the Website, including when registering, applying for an Audition, obtaining a Class Pass, receiving Services or interacting with the Website’s features.

2.3. This Policy does not apply to legal relationships between the User and third parties and does not govern personal data processing carried out by third parties, including organisers of competitions, festivals and other events, whose privacy policies the Company refers to separately.

2.4. The Policy applies exclusively to the Website and the Company’s services. The Company does not control, and is not responsible for, third-party websites and/or services that the User may access through links on the Website.

3. GENERAL PROVISIONS

3.1. The User indicates agreement to the terms of this Policy through conduct demonstrating consent, including ticking the “I consent to the processing of personal data” checkbox, registering on the Website, applying for an Audition, completing contact forms or entering personal data in Website interfaces.

3.2. If the Student is a minor, consent to the processing of their personal data, including special categories of personal data and photographs and videos featuring them, is given by their parent or legal representative. The parent or legal representative is responsible for the lawfulness and validity of such consent and the accuracy of the data provided.

3.3. Performing the actions specified in Clause 3.1 of this Policy confirms that the User: (1) has read the terms of the Policy; (2) understands its content; and (3) consents to the processing of their personal data and, where there is a minor Student, that Student’s personal data, to the extent and for the purposes set out in the Policy.

3.4. If the User disagrees with the terms of this Policy, they must stop using the Website. In that case, the use of individual Website features that require personal data, including booking an Audition, may be restricted or unavailable.

4. CATEGORIES AND CONDITIONS OF PERSONAL DATA PROCESSING

4.1. The Company processes the personal data of Users and Students in accordance with this Policy and the laws of the Republic of Kazakhstan.

4.2. Depending on the Website’s features and the User’s interaction with the Website, the Company may process the following categories of personal data:

4.2.1. The User’s personal details: first name, surname and patronymic, if any;

4.2.2. The Student’s personal details: first name, surname, date of birth, age, dance style and class group;

4.2.3. Contact details: email address and mobile phone number;

4.2.4. Payment data: information about whether payment has been made, payment status and payment amount (the Company does not store Users’ bank card details);

4.2.5. Information about the Student’s health, namely the presence or absence of medical contraindications to physical activity, is processed as a special category of personal data exclusively with the User’s separate, explicit consent and only to the extent necessary to ensure the Student’s safety during Classes;

4.2.6. Photographs and videos featuring the Student, obtained during Classes, open classes, concerts and competitions, are used for the purposes specified in Section 6 of this Policy, subject to the User’s right to refuse such use;

4.2.7. Communication data: the content of the User’s messages, applications, feedback and requests, where they contain personal data;

4.2.8. Technical data: IP address, cookie data, browser and device information, date and time of access, and actions on the Website;

4.2.9. Analytics data: information about Website visits obtained through web analytics systems, including Yandex Metrica, Google Analytics and similar services.

4.3. When payments are made through the Website, the Company may request the User’s individual identification number (IIN) where provided for by the Website’s features and/or the laws of the Republic of Kazakhstan. Payment data are processed through third-party payment systems (online acquiring services).

4.4. By providing personal data, including the Student’s personal data, the User consents to their processing by the Company, including collection, recording, systematisation, accumulation, storage, updating, use, transfer in the cases provided for by law and this Policy, depersonalisation, blocking and destruction.

5. RIGHTS OF THE USER AND THE STUDENT’S LEGAL REPRESENTATIVE

5.1. The User’s consent to the collection and processing of personal data takes effect when it is given and remains valid until the purposes of processing have been achieved or the consent is withdrawn, unless otherwise provided by the laws of the Republic of Kazakhstan.

5.2. The User, including when acting in the interests of a minor Student, is entitled to:

5.2.1. Obtain information about whether the Company holds personal data and about their processing;

5.2.2. Request that personal data be amended and/or supplemented if they are incomplete, outdated, inaccurate or obtained unlawfully;

5.2.3. Request that personal data be blocked or destroyed in the cases provided for by the laws of the Republic of Kazakhstan;

5.2.4. Obtain information about third parties to whom personal data have been transferred, including organisers of competitions and festivals in which the Student participates;

5.2.5. Withdraw consent previously given to the collection, processing and transfer of personal data and, separately, consent to the use of photographs and videos featuring the Student, except where processing is carried out on grounds provided for by the laws of the Republic of Kazakhstan;

5.2.6. Challenge the Company’s actions or omissions concerning the collection and processing of personal data in accordance with the procedure established by the laws of the Republic of Kazakhstan.

5.3. To exercise the rights set out in this section, the User may send a corresponding request to the Company by email or using other contact details published on the Website.

5.4. The User’s request must contain information that allows the User and/or the Student to be identified, together with a description of the demand, request or objection concerning the processing of personal data.

5.5. The Company considers Users’ requests within 10 (ten) working days of receiving them.

5.6. Withdrawal of consent to personal data processing, including consent to the processing of health information, may make it impossible to continue providing Services, including admitting the Student to Classes, if processing the relevant data is necessary to provide them.

6. PURPOSES OF PERSONAL DATA PROCESSING

6.1. The Company collects and processes the personal data of Users and Students for the following purposes:

6.1.1. Identifying the User and the Student when they use the Website;

6.1.2. Registering the User on the Website and providing access to individual Website features, including the Account;

6.1.3. Conducting Auditions (selection) and forming Groups by age, dance style and level of preparation;

6.1.4. Providing the Company’s Services to the User and the Student, including maintaining the Timetable and giving notice of changes, rescheduling and cancellation of Classes;

6.1.5. Ensuring the Student’s safety during Classes, including taking health information into account;

6.1.6. Concluding, performing, amending and terminating agreements between the Company and the User;

6.1.7. Processing payments and confirming payment for Services;

6.1.8. Enabling the Student to participate in open classes, concerts, competitions and festivals, including international events, and communicating with their organisers;

6.1.9. Promoting the Company’s activities, including by using photographs and videos featuring Students on the Website and the Company’s social media accounts;

6.1.10. Sending the User organisational and informational notices and messages relating to use of the Website and the provision of Services;

6.1.11. Providing the User with advisory, informational and technical support;

6.1.12. Improving the Website’s operation, analysing its use, developing new services and improving the quality of the Services provided;

6.1.13. Conducting statistical, analytical and marketing research based on depersonalised data;

6.1.14. Sending advertising, informational and marketing materials about the Company’s activities, special offers, promotions and events;

6.1.15. Ensuring the Website’s security and preventing fraud and infringements of the rights of the Company and third parties;

6.1.16. Complying with the laws of the Republic of Kazakhstan.

6.2. The grounds for processing personal data are: the User’s consent to the collection and processing of personal data, including when acting in the interests of a minor Student; the need to perform an agreement to which the User is a party; the need to fulfil obligations imposed on the Company by the laws of the Republic of Kazakhstan; and other grounds provided for by those laws.

6.3. The Company processes personal data for the period necessary to achieve the purposes specified in this Policy, unless the laws of the Republic of Kazakhstan require a longer retention period.

7. PERSONAL DATA PROTECTION

7.1. The Company does not verify the accuracy of personal data provided by the User and proceeds on the basis that the User voluntarily provides accurate and up-to-date personal data, including concerning the Student, and has all necessary rights, including the authority of a legal representative, to provide them to the Company.

7.2. In processing personal data, the Company follows the principles of lawful and fair processing; limiting processing to specific, predetermined and lawful purposes; preventing processing that is incompatible with the purposes of data collection; ensuring that the scope and content of the data processed correspond to the stated purposes; ensuring that data are accurate, sufficient and up to date; and retaining data no longer than required for the purposes of processing.

7.3. The Company takes the necessary organisational, technical and legal measures to protect personal data, including the data of Students as a particularly vulnerable category of data subjects, against unlawful or accidental access, destruction, alteration, blocking, copying, dissemination, disclosure and other unlawful actions by third parties.

7.4. Personal data may be processed both with and without automated means.

8. TRANSFER OF PERSONAL DATA

8.1. The Company may transfer the personal data of Users and Students to third parties in the cases provided for by this Policy and the laws of the Republic of Kazakhstan, for the purposes of fulfilling its obligations to the User; operating the Website and the Company’s information systems and services; processing payments and carrying out settlements; providing technical, informational and other support; and complying with the laws of the Republic of Kazakhstan.

8.2. The Company may transfer personal data to persons engaged to operate the Website and provide Services, including telecommunications operators, hosting providers, software suppliers, payment organisations, banks and other organisations whose participation is necessary for the Website’s operation and the performance of the Company’s obligations.

8.3. Where the Student participates in competitions, festivals or other events, including international events, the Company may transfer the necessary personal data of the Student, namely their full name, age and photographs and videos of performances, to the organisers exclusively with the User’s consent and only to the extent necessary to participate in the relevant event.

8.4. Personal data are transferred outside the Republic of Kazakhstan in compliance with its laws governing cross-border transfers of personal data, including obtaining the User’s separate consent where required by applicable law.

8.5. The Company may provide personal data to government bodies, law enforcement agencies, courts and other authorised persons in the cases and in the manner provided for by the laws of the Republic of Kazakhstan.

8.6. Persons to whom the personal data of Users and Students are transferred must ensure the confidentiality and security of those data in accordance with the laws of the Republic of Kazakhstan.

8.7. The Company may use and transfer to third parties depersonalised data, statistical information and the results of data analysis for the purposes of analysing the Website’s operation, improving the quality of Services and conducting marketing, statistical and other research.

8.8. Transfers of personal data in the cases provided for by this Policy do not constitute a breach of the Company’s obligations to maintain the confidentiality of personal data.

9. OTHER PROVISIONS

9.1. The Company undertakes to take all necessary organisational and technical measures to ensure the confidentiality, integrity, preservation and availability of the personal data of Users and Students.

9.2. The Company ensures that personal data are processed in accordance with this Policy, the Law of the Republic of Kazakhstan on Personal Data and Their Protection, and other laws and regulations of the Republic of Kazakhstan.

9.3. This Policy is a publicly available document published on the Website.

9.4. The Company may amend and/or supplement this Policy at any time without prior notice to Users. A new edition of the Policy takes effect when published on the Website, unless it specifies a different effective date.

9.5. Continued use of the Website after a new edition of the Policy has been published means that the User has read the new edition and agrees to its terms.

9.6. If the User disagrees with the terms of this Policy or any amendments to it, they must stop using the Website and its features.

9.7. If any provisions of this Policy are held to be invalid, unlawful or unenforceable, this does not invalidate the remaining provisions.

9.8. The laws of the Republic of Kazakhstan apply to relationships concerning the collection, processing, protection and transfer of the personal data of Users and Students.

9.9. For questions concerning personal data processing, the exercise of data subject rights or the application of this Policy, the User may contact the Company at: ldc@pkf.kz

10. COMPANY DETAILS

Legacy Dance Consulting LLP BIN: 260340009958 Registered address: Republic of Kazakhstan, Almaty, 42 Timiryazev Street, Pavilion 15, Office 401 Bank: Bank CenterCredit JSC BIC: KCJBKZKX KZ108562203153871283