Privacy Policy

Version No. 2 dated October 18, 2026
Effective date: October 28, 2026

1. General Provisions

1.1. This Privacy Policy (the "Policy") sets out how personal data of users of the ORDO platform, available at ordo.education, and of related applications and services (the "Platform") is collected, processed, stored and protected.

1.2. This Policy has been prepared in accordance with Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Its Protection" dated May 21, 2013, and other regulatory legal acts of the Republic of Kazakhstan.

1.3. By using the Platform, the user confirms that they have read this Policy. Personal data is processed on the basis of consent given by the data subject or their legal representative, as well as in other cases provided for by the legislation of the Republic of Kazakhstan.

1.4. This Policy also applies to personal data received by the Platform through messengers connected by a Client Organization, and to the operation of the Platform's AI Assistant (Sections 14 and 15). By messaging a Client Organization through a connected messenger or booking a visit, the user confirms that they have read this Policy.

2. Operator Details

ORDO ERP Limited Liability Partnership
BIN: 220140024194
Registered address: Office 16, 34B Turkestan Street, Astana, Republic of Kazakhstan
Bank: Kaspi Bank JSC
BIC: CASPKZKA
IBAN: KZ51722S000036453755
Beneficiary code (KBe): 17
Email: info@ordo.education

3. Definitions

3.1. Personal data means information relating to an identified or identifiable data subject, recorded on electronic, paper and/or other tangible media.

3.2. Processing of personal data means actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalization, blocking and destruction of personal data.

3.3. User means an individual who uses the Platform, including an employee, student or pupil, or the legal representative of a student or pupil, of an organization connected to the Platform.

3.4. Client Organization means a legal entity (including an educational organization) that has entered into an agreement with ORDO ERP LLP for the use of the Platform.

3.5. Messengers means the WhatsApp Business Platform and Instagram services of Meta Platforms, Inc., as well as Telegram, which a Client Organization connects to the Platform to communicate with users, including legal representatives of students and pupils.

3.6. AI Assistant means a software service of the Platform based on artificial intelligence technologies that, on behalf of a Client Organization, responds to user inquiries in messengers, books visits and sends reminders.

4. Data We Collect

4.1. Personal data provided by the user or the Client Organization: full name; individual identification number (IIN); date of birth; phone number; email address; information about the place of study or work; other data required for the operation of the Platform.

4.2. Technical data collected automatically: IP address, device and browser type, operating system, approximate location, data on activity on the Platform, and cookies.

4.3. Payment data. Payments are processed by payment service providers. ORDO ERP LLP does not store full bank card details. We only have access to information about the fact, amount and status of a payment. Purchases in the iOS mobile app are paid through the App Store; in that case, payment data is processed by Apple and we do not receive it.

4.4. Messenger conversation data: name, phone number or messenger account ID, username, content of messages and attachments (text, photos, voice messages and their transcripts, documents), date and time of messages, and delivery and read statuses.

4.5. Visit booking data for a Client Organization: name of the legal representative, contact phone number, child's first name and age, type, date and time of the visit, booking status, and source of the inquiry.

5. Purposes of Processing

5.1. We process personal data for the following purposes:

- registering and identifying users and providing access to the Platform;
- performing agreements with users and Client Organizations;
- operating Platform features and providing technical support;
- sending service notifications;
- accepting and processing payments and preventing fraud;
- analyzing and improving the Platform;
- displaying users' conversations with a Client Organization in its account on the Platform and responding to inquiries, including with the help of the AI Assistant;
- booking visits to a Client Organization and sending confirmations and reminders about them;
- sending informational and marketing messages, only with the user's separate consent;
- complying with the legislation of the Republic of Kazakhstan.

5.2. We do not process personal data for purposes incompatible with the purposes for which it was collected.

6. Data of Minors

6.1. The Platform may be used by educational organizations, and as a result personal data of persons under the age of eighteen may be processed.

6.2. Consent to the processing of a minor's personal data is given by the minor's legal representative (parent, guardian or custodian).

6.3. Where data of minors is entered into the Platform by a Client Organization, the Client Organization is responsible for obtaining the consent of the legal representatives. ORDO ERP LLP processes such data solely on behalf of the Client Organization and for the purposes defined in the agreement with it.

6.4. We do not use personal data of minors for advertising and do not share it with third parties for advertising purposes.

6.5. When a visit is booked through messengers, the AI Assistant and the Client Organization's staff ask only for the child's first name and age.

7. Cookies

7.1. The Platform uses the following cookies:

- strictly necessary cookies, for authentication and proper operation of the Platform;
- analytics cookies, to measure traffic and improve the service.

7.2. Users can restrict or disable cookies in their browser settings. Disabling strictly necessary cookies may prevent the Platform from working properly.

8. Disclosure to Third Parties

8.1. We do not sell personal data. Personal data may be disclosed to third parties only:

- to service providers acting on our behalf under an agreement (hosting, payment systems, notification services, analytics), to the extent necessary for them to provide such services;
- to Meta Platforms, Inc. and Telegram, to the extent necessary to deliver messages through messengers connected by a Client Organization;
- to an artificial intelligence technology provider acting on our behalf under an agreement, to the extent necessary for the operation of the AI Assistant (Clause 15.4);
- to ORDO LIMITED (Astana International Financial Centre, BIN 260640900685), the owner of the Platform and a member of our group of companies, to the extent necessary to operate, develop and support the Platform;
- to the Client Organization, with respect to data of its employees, students and pupils, and their legal representatives;
- to government authorities, in the cases and manner provided for by the legislation of the Republic of Kazakhstan;
- to a legal successor in the event of a reorganization, sale or transfer of the business, provided that the successor complies with this Policy.

8.2. Recipients of personal data are required to keep it confidential and ensure its protection.

9. Storage Location and Cross-Border Transfer

9.1. Personal data is stored in databases located in the Republic of Kazakhstan.

9.2. Cross-border transfer of personal data is carried out only in the cases and manner provided for by the legislation of the Republic of Kazakhstan.

9.3. When messages are delivered through messengers, data passes through servers of Meta Platforms, Inc. and Telegram, which may be located outside the Republic of Kazakhstan. When the AI Assistant is in use, the text of an inquiry may be processed on servers of the artificial intelligence technology provider located outside the Republic of Kazakhstan. Such transfer is carried out in accordance with Clause 9.2.

10. Retention Periods

10.1. Personal data entered into the Platform by a Client Organization (including data of pupils, students, their legal representatives and employees) is retained for the term of the agreement with the Client Organization, as well as for the periods established by the legislation of the Republic of Kazakhstan, including the List of Standard Documents Generated in the Activities of State and Non-State Organizations, Indicating Retention Periods. Upon termination of the agreement, such data is transferred to the Client Organization or destroyed on its instructions.

Other personal data of users is retained for as long as the user account is active and is destroyed or depersonalized within 30 calendar days after the account is deleted, except for data whose retention period is established by law (including accounting and tax records).

10.2. Once the purposes of processing have been achieved, or if consent is withdrawn (unless otherwise provided by law), personal data is destroyed or depersonalized.

10.3. Messenger conversation data is retained for the period set by the Client Organization in the Platform settings (by default, 1 year from the date of the last message) and is then destroyed. When a Client Organization's data is deleted, its conversations are destroyed together with it.

11. Data Protection

11.1. We apply legal, organizational and technical measures to protect personal data against unauthorized access, modification, destruction, copying and dissemination, including:

- encryption of data in transit;
- encryption of access keys for connected messengers;
- segregation and monitoring of employee access rights;
- regular backups;
- logging of system activity.

11.2. In the event of a personal data security breach, we notify the competent authority and, where necessary, affected users in the manner and within the time limits established by the legislation of the Republic of Kazakhstan.

12. User Rights

12.1. The user (or their legal representative) has the right to:

- know whether we hold their personal data and receive information about its processing;
- request that their personal data be updated or supplemented;
- request that their personal data be blocked where there are grounds to do so;
- request that their personal data be destroyed if it is processed in violation of the law or the purposes of processing have been achieved;
- withdraw consent to the processing of personal data, except in cases established by law;
- opt out of marketing messages at any time;
- opt out of messages in messengers by replying "STOP" or by contacting the Client Organization;
- request that a conversation with the AI Assistant be transferred to a staff member of the Client Organization;
- file a complaint about our actions with the competent authority for personal data protection or with a court.

12.2. To exercise these rights, the user may send a request to info@ordo.education. We consider requests within the time limits established by the legislation of the Republic of Kazakhstan.

12.3. Where the user's data was entered into the Platform by a Client Organization, the request may also be sent to that organization.

12.4. A request to delete data received through messengers may also be sent to info@ordo.education. Such data is destroyed within 30 calendar days, unless a different retention period is established by law.

13. Changes to this Policy

13.1. We may update this Policy. The current version, with its effective date, is always available at ordo.education.

13.2. We will additionally notify users of material changes by email or through their personal account at least 10 calendar days before the changes take effect.

14. Messenger Integration

14.1. A Client Organization may connect its WhatsApp Business account, Instagram professional account and Telegram bot to the Platform. Once connected, messages that users send to the Client Organization in these messengers are displayed in the Client Organization's account on the Platform, and replies from its staff and the AI Assistant are sent back to the same messenger.

14.2. Messengers are connected only through official application programming interfaces: the WhatsApp Business Platform (Cloud API) and Instagram API of Meta Platforms, Inc., and the Telegram Bot API.

14.3. With respect to conversation data, ORDO ERP LLP acts on behalf of the Client Organization and for the purposes defined in the agreement with it.

14.4. Data received through messengers is used only for the purposes set out in Clause 5.1. It is not sold, not used for advertising and not disclosed to third parties, except in the cases set out in Section 8.

14.5. Data received through the WhatsApp Business Platform and Instagram API is also processed in accordance with the terms and policies of Meta Platforms, Inc., and data received through Telegram in accordance with Telegram's terms.

14.6. A Client Organization may disconnect a messenger in the Platform settings at any time. Once a messenger is disconnected, messages are no longer received or sent through the Platform.

15. AI Assistant

15.1. A Client Organization may enable the AI Assistant, which, on its behalf, replies to users in messengers based on information provided by the Client Organization (address, opening hours, groups, prices, programs, answers to frequently asked questions), books visits into available slots according to the Client Organization's schedule, and sends reminders.

15.2. In its first message, the AI Assistant states that it is an automated assistant of the Client Organization. The user may ask to speak with a staff member at any time, and the conversation will be transferred to a staff member of the Client Organization.

15.3. The AI Assistant does not accept payments, does not request bank card details, does not provide medical or legal advice, and does not make decisions that have legal consequences for the user.

15.4. To generate a reply, the text of the inquiry and the necessary conversation context are sent to an artificial intelligence technology provider acting on behalf of ORDO ERP LLP under an agreement. The provider processes this data only to generate the reply and does not use it to train its models.

15.5. All AI Assistant replies are stored in the conversation history. The Client Organization's staff can review them and take over the conversation.

16. Contact Us

For questions regarding the processing of personal data, please contact:

ORDO ERP LLP
Email: info@ordo.education
Mailing address: Office 16, 34B Turkestan Street, Astana, Republic of Kazakhstan