Personal data
processing policy.

1. Data controller

The personal data controller is Institution “Khoja Akhmet Yassawi International Kazakh-Turkish University”, BIN 990440008043. YASAWI STARTUP and the Commercialization Office act as University units and are not separate controllers.

Personal data contact: yassawi_commerc@ayu.edu.kz. Contact address: 29 Bekzat Sattarkhanov Street, Turkistan, Kazakhstan. Telephone: 8 (72533) 6-36-36.

2. Scope

This policy applies to website visitors, applicants, their legal representatives and program participants when their data is collected through the website. It does not govern third-party websites reached through external links.

3. Data processed

The public form does not request a national identification number, identity-document details, biometric, medical or payment data. Do not enter such information or another person's confidential data in the free-text field.

• application data: selected program, surname, given name and patronymic if applicable, email, telephone number, and a description of an idea, project or learning objective;
• optional data when the relevant fields are used: institution, faculty, team information and selected cohort;
• consent evidence: the fact, date and version of consent, selected language, and confirmation of the applicant's or legal representative's authority;
• technical data: request time, website language, user-agent, hashed IP address, referral source and UTM tags when present;
• communications and application review information, including status, internal notes and decision history.

4. Purposes and legal grounds

The primary legal ground is the consent of the applicant or legal representative. If an applicant becomes a participant, certain processing may be necessary to enter into or perform an agreement or to comply with the laws of Kazakhstan. Data is not used for marketing messages without separate voluntary consent.

• receiving, checking and reviewing an application;
• contacting the applicant and arranging an interview;
• identifying a suitable program, forming a cohort and organizing participation;
• preventing spam, duplicate submissions and abuse;
• maintaining verifiable records of consent and staff actions;
• complying with legal requirements and protecting the rights of the University and applicant.

5. Processing operations

For the stated purposes only, the controller may collect, record, organize, accumulate, store, correct, use, retrieve, disclose to authorized processors, restrict, anonymize, erase and destroy data.

6. Access, processors and disclosure

Access is limited to authorized University staff who need the data for selection and program support. Providers of hosting, databases, backups, object storage and email may process the minimum necessary data under contract and confidentiality obligations.

Data may be disclosed to public authorities or other persons when the law expressly requires it. Applicant databases may not be sold or shared for another party's advertising.

• the main application database and its backups must be located in the Republic of Kazakhstan;
• cross-border transfer is possible only where approved cloud or email services require it, on a lawful basis and in compliance with Article 16 of the Kazakhstan Law on Personal Data and its Protection;
• application data is not disseminated in publicly accessible sources. Publishing a participant's name, image, project or result requires separate consent.

7. Retention

Once a purpose is achieved or a period expires, data is erased, destroyed or anonymized unless the law requires further retention. The University may approve shorter periods through an internal act.

• an application that is not accepted: up to 12 months after the final decision;
• accepted participant data: during the program and for up to 3 years after completion;
• technical security logs: up to 12 months;
• minimal evidence needed to demonstrate consent or defend legal rights: for the applicable limitation period.

8. Data subject rights

Requests should be sent to yassawi_commerc@ayu.edu.kz. To protect the data, the controller may request information sufficient to verify identity. After withdrawal, processing is stopped within the period required by law or the applicant receives a reasoned refusal.

• learn whether the controller holds their personal data and obtain information about purposes, sources, methods and periods of processing;
• receive a list of their data and request correction;
• request restriction or deletion where there are lawful grounds;
• withdraw consent unless this conflicts with law or an outstanding obligation;
• complain to the competent authority or a court.

9. Security and incidents

The controller uses access controls, authentication, logging of administrative actions, encrypted communications, backups and organizational safeguards. If a security breach occurs, the controller follows an approved response plan and meets applicable obligations to notify the competent authority and data subjects within the periods required by law.

10. Cookies

The site uses technically necessary cookies: yasawi_locale stores the selected language, while protected admin cookies maintain authorized employee sessions. As of this version, the site uses no advertising cookies and sets no third-party analytics cookies. If such tools are introduced, the policy and choice mechanism will be updated before they are enabled.

11. Minors

If an applicant cannot provide valid consent independently, the application and consent must be provided by a legal representative. A person submitting the form confirms that they are the applicant or are authorized to act on the applicant's behalf.

12. Changes and languages

A new version applies to data collected after its publication date. If a change expands the purposes, data categories, recipients or cross-border transfers, the controller obtains new consent where required by law.

The document is available in Kazakh, Russian, English and Turkish. The Kazakh and Russian texts are intended for official use; the English and Turkish translations are provided for convenience. In the event of inconsistency, the laws of Kazakhstan and clarification by the controller apply.

13. Legal framework

This policy takes account of the Kazakhstan Law on Personal Data and its Protection, the Rules for the Collection and Processing of Personal Data, and the Rules for Implementing Personal Data Protection Measures.