Privacy Policy

1. General Provisions

1.1. The Operator prioritizes safeguarding human rights when processing personal data, including protections for privacy and family confidentiality.

1.2. This Privacy Policy applies to all information collected from visitors to https://uvu.kz and users of mobile applications: "UvU Family," "UvU Shuttle," and "UvU Driver."

1.3. The purpose of this document is to disclose: (1) types of collected personal information; (2) collection methods; (3) purposes for collection; (4) storage periods and user rights; (5) entities with data access.

2. Key Concepts

2.1. Automated Processing

— personal data processing using computing technology.

2.2. Data Blocking

— temporary cessation of processing (except when needed for clarification).

2.3. Website

— graphical materials, information, software, and databases accessible at https://uvu.kz.

2.4. Mobile Application

— software designed for smartphones, tablets, and devices on specific platforms (iOS, Android). Includes "UvU Family," "UvU Shuttle," and "UvU Driver."

2.5. Personal Data Information System

— databases containing personal data and the technologies used to process them.

2.6. De-identification

— actions making it impossible to determine data ownership without additional information.

2.7. Personal Data Processing

— any action or series of actions (automated or manual) including collection, recording, systematization, storage, refinement, extraction, usage, transmission, de-identification, blocking, deletion, or destruction.

2.8. Operator

— a governmental, municipal, or private entity that organizes and conducts data processing and determines its purposes, data types, and operations.

2.9. Personal Data

— information that directly or indirectly identifies website or application users.

2.10. Distribution-Permitted Data

— personal data whose unlimited access the subject authorized through written consent.

2.11. User

— any website or application visitor.

2.12. Data Provision

— disclosure of data to specific persons or groups.

2.13. Data Distribution

— disclosure of data to unlimited persons, including publication or providing access by any means.

2.14. Cross-Border Transfer

— transmitting data to foreign territories or entities.

2.15. Data Destruction

— irreversible elimination of data with no possibility of recovery.

3. Operator Rights and Obligations

3.1. Operator Rights

• Obtain accurate information and documents containing personal data.
• Continue processing after consent withdrawal if other legal grounds exist.
• Independently determine necessary security measures.

3.2. Operator Obligations

• Provide data subjects with information regarding their data processing upon request.
• Process data in accordance with the legislation of the Republic of Kazakhstan.
• Respond to data subject inquiries within the legally prescribed timeframes.
• Inform competent authorities within 30 days of their requests.
• Publish and maintain an accessible privacy policy.
• Implement legal, organizational, and technical protections for personal data.
• Cease transmission, processing, or destroy data as required by law.
• Fulfill all other statutory obligations.

4. Data Subjects' Rights and Obligations

4.1. Rights

• Obtain information about how their data is being processed (except in legally restricted cases).
• Require clarification, blocking, or destruction of incomplete, outdated, or inaccurate data.
• Require prior consent for the use of personal data for marketing purposes.
• Withdraw processing consent at any time.
• Challenge the Operator's actions through competent authorities or the courts.
• Exercise other rights provided by law.

4.2. Obligations

• Provide accurate personal information.
• Notify the Operator of any clarifications or updates to their data.

4.3. Those submitting false information or another person's data without their consent bear legal responsibility.

5. Types of Personal Data Processed

• Full name
• Email address
• Phone numbers
• Geolocation data
• De-identified visitor data (cookies) collected via analytics services (e.g. Google Analytics)

The Operator does not process special categories of personal data (race, nationality, political views, religious beliefs, health status, or intimate life).

Processing of distribution-permitted special category data requires a separate, dedicated consent in accordance with Section 10.1 of applicable law. Users provide consent directly; operators must publish processing conditions within three business days; transmission ceases upon demand; consent terminates upon a cessation request.

6. Principles of Data Processing

• Processing occurs lawfully and fairly.
• Processing is limited to specific, predetermined, and lawful purposes; incompatible processing is prohibited.
• Consolidation of databases with incompatible purposes is prohibited.
• Only data necessary for the stated purposes is processed.
• The volume of data collected must match the stated purposes; excessive data collection is prohibited.
• Data accuracy, sufficiency, and currency are ensured; incomplete or inaccurate data is corrected or deleted.
• Storage is restricted to the duration necessary for the purpose, as defined by law or contract; data is destroyed or de-identified upon purpose completion.

7. Purposes of Data Processing

7.1. The Operator processes personal data for the following purposes:

• Notifying users via email.
• Concluding, executing, and terminating service contracts.
• Providing access to website and application services.

7.2. The Operator may send notifications about products, services, and offers. Users may opt out by sending an email to info@uvu.kz with the subject "Notification Refusal."

7.3. De-identified analytics data is used to improve website quality and content.

8. Legal Bases for Processing

8.1. The legal bases for processing include:

• The Operator's constitutional documents.
• Contracts between the Operator and data subjects.
• Applicable laws and protective regulations.
• User consent.

8.2. Processing occurs only when users voluntarily complete forms or submit data; form submission constitutes acceptance of this Policy.

8.3. De-identified processing requires browser settings that allow cookies and JavaScript.

8.4. Data subjects independently decide whether to provide their data, doing so with free and informed consent.

9. Conditions for Processing

• Processing requires data subject consent.
• Processing is necessary for international treaty or legal objectives and functions imposed on the Operator.
• Processing is necessary for the administration of justice, judicial acts, or enforcement orders.
• Processing is necessary for contract execution or conclusion where the data subject is a party, beneficiary, or guarantor.
• Processing serves the Operator's or a third party's legitimate interests, or public goals, without violating the data subject's rights.
• Processing of publicly disclosed data is permitted.
• Processing of legally mandated publication data is permitted.

10. Data Collection, Storage, and Transmission

10.1. The Operator ensures data preservation and prevents unauthorized access.

10.2. Data is never transferred to third parties except as required by law or with data subject consent for the fulfillment of contractual obligations.

10.3. Users may update inaccurate data by sending an email to info@uvu.kz with the subject "Data Update."

10.4. The duration of processing is determined by the achievement of the stated purpose, unless otherwise specified by contract or law. Users may withdraw consent by emailing info@uvu.kz with the subject "Consent Withdrawal."

10.5. Third-party services (payment systems, service providers) store and process data according to their own agreements; the Operator is not responsible for third-party actions.

10.6. User-imposed distribution restrictions do not apply to processing required by government authorities or in the public interest.

10.7. The Operator maintains data confidentiality.

10.8. Data storage continues only for as long as the stated purpose requires, unless otherwise specified by law.

10.9. Processing ceases upon purpose achievement, consent expiration, consent withdrawal, or detection of unlawful processing.

11. Operator's Data Actions

11.1. The Operator collects, records, systematizes, accumulates, stores, refines, extracts, uses, transmits, de-identifies, blocks, deletes, and destroys personal data.

11.2. Automated processing occurs with or without information network transmission.

12. Cross-Border Transfers

12.1. The Operator must verify that the foreign destination provides reliable protection for data subjects before initiating any cross-border transfer.

12.2. Transfers to destinations with inadequate protection require either the written consent of the data subject or contractual necessity.

13. Data Confidentiality

The Operator and any recipients with access to personal data must not disclose or distribute such data without the data subject's consent, unless required by law.

14. Account Deletion

Users may permanently delete their accounts and all associated data by following these steps:

1. In the "Profile" tab, tap the (...) button beside your phone number and select the red "Delete Account" button.
2. Confirm the deletion in the popup window.
3. All account data and history will be permanently deleted with no possibility of recovery.

15. Concluding Provisions

15.1. Inquiries regarding this policy may be directed to info@uvu.kz.

15.2. Changes to this policy will be reflected in this document. The policy operates indefinitely until replaced by a new version.

15.3. The current version of this Privacy Policy is available at https://uvu.kz/privacy.