Privacy Policy

Version and application

Version dated 24 October 2026.

These documents set out the terms for using the website and processing personal data. The agreed contract, programme, invoice and other documents also apply to a specific service where relevant.

The current version is published on this page. New service terms apply to new enquiries and orders and do not automatically change previously agreed obligations. Policy changes do not automatically expand the purposes for processing previously collected data; new consent is requested separately where needed. The operator communicates material changes affecting an ongoing relationship through the available contact details.

Operator and purpose of the website

RESCIE organizes and oversees personal data processing. At the initial stage, these matters are coordinated by the head of the organization. Enquiries should be sent to info@rescie.com.

The organization uses RESCIE as the public name of its activities. Operator details: RESCIE, business identification number 230940003866. Registered address: Apt. 5, 2/6 Bauyrzhan Momyshuly Avenue, Almaty District, Astana. Office: 47A Tauelsizdik Avenue, Astana. Email: info@rescie.com. Phone: +7 706 888 9365.

This policy describes data processing when making an enquiry through the website, applying, registering for a programme, assigning access to learning and publicly verifying documents.

What data is processed

Enquiry forms contain the contact person's name, email, phone number if provided, and message. An organizational enquiry may also contain the organization's name, the contact person's job title, city, organization type, service of interest, expected participant numbers and dates.

A programme application or registration contains the participant's name, email, phone number if provided, selected programme and, for applications, the motivation and experience information supplied by the applicant. A group organizer provides only the necessary participant information.

Participation support involves processing application, enrolment, payment and access statuses, the charged amount and currency, the administrator's payment confirmation and details of an issued document. Bank card details are not requested through website forms; the current payment process does not use an integrated payment gateway.

The consent record, creation and update times, enquiry source and any referral/UTM parameters are retained. The website infrastructure also processes technical request information. The administrative area uses email, password hashes and administrative session information; passwords are not included in public data.

How data is used

Data is used to respond to enquiries, agree programmes and contracts, review applications, record participation and payment, assign access, issue and verify documents, correct errors and protect the website from misuse.

Providing an email address in a form does not itself constitute consent to advertising emails. Enquiries and statuses are handled by an administrator. Operational emails may notify the administrator of the enquiry type, record number and a link to the protected administrative panel, without names, contact details or enquiry text. Automated customer notifications and advertising mailings are not enabled.

Grounds for processing and group applications

Processing takes place where the necessary consent or another applicable lawful basis exists. By selecting the required consent checkbox and submitting the form, the applicant confirms the accuracy of the information and consents to processing for reviewing the enquiry, application or registration and the related actions described in this policy. Do not provide unnecessary information. This checkbox does not constitute consent to marketing messages.

When providing information about other participants, the organization's representative must have an appropriate basis for doing so and ensure participants are informed of the processing terms. Public display of document information requires a separate appropriate basis; the representative's consent does not replace a participant's consent where the latter is required.

Public document verification

Verification by a document's unique identifier displays the programme, hours where available, issue date, expiry date where applicable, and document status. The participant's name, email, phone number, payment information and administrative sessions are not included in the public result. Names are held in an internal register with restricted access.

A link or QR code allows the recipient to open the verification result. Consider the public nature of this information before sharing a link. Questions about corrections or ending public display can be sent to the operator's stated email; the basis and feasibility of changing a record are assessed when the enquiry is reviewed.

Cookies and technical information

The attr cookie stores enquiry-source, referral and UTM information in the browser for up to 30 days. The sid cookie is used for administrator login; a session lasts up to 8 hours unless ended earlier. These are not the retention periods for all database records.

Cookies can be deleted or restricted through browser settings. Restricting administrative sessions may prevent administrator login. Request IP addresses are used to limit form-submission frequency; the current counter runs in the server process's memory.

Service providers and hosting

RESCIE's production website and PostgreSQL database use PS.kz infrastructure in Almaty, Kazakhstan. The application connects to the database over a private network with TLS and server-certificate verification. This hosting description is not in itself a statement of compliance with all personal-data processing requirements.

Before real enquiries are processed, the permitted storage arrangement and the terms for engaging providers and cross-border processing must be approved. Where access is assigned on an external platform, the necessary data to be shared and the applicable terms are communicated to the participant before transfer. RESCIE's own educational platform is not currently an active means of providing access.

Retention, correction and enquiries

For applications without a contract, payment or reservation, the internal retention period is up to 12 months after the last substantive contact. Following a final refusal, it is up to 6 months from the refusal date, without extending the original 12-month limit. An automated message or internal record edit does not restart the period. Learning-participation information is retained during the programme and for 3 years after completion. A minimal internal certificate register is retained for 5 years after issue; this does not extend retention of the participant's full questionnaire. Extending register retention requires a documented basis. Contractual and financial documents are retained separately by document category and applicable mandatory periods. Expiry of an internal period triggers a manual review of the need for further retention. Active contracts, settlements, disputes and other applicable obligations are checked. Where no grounds remain, personal data and free-text entries are deleted; aggregate statistics without identifiers may be retained. Automatic age-based record deletion is not implemented in the current application. Website logs have rotation configured with a target of up to 30 days; actual deletion depends on the rotation mechanisms operating. Records needed to investigate an incident are considered separately, with restricted access and a documented retention period. Automated backups are scheduled daily, with a limit of one latest successful copy. According to PS.kz, the previous copy is deleted after a new copy is successfully created and is retained if copying fails. Stopping the schedule does not delete existing copies; early deletion is available through provider tools. Manual copies are tracked separately with review or deletion dates. Deletion from the working database does not mean immediate deletion from earlier backups. On restoration, recorded deletions and restrictions must be reapplied before data returns to the working system.

You can request information about processing, correction, restriction, deletion or withdrawal of consent through info@rescie.com. Provide enough information to locate your record, such as the email used for your enquiry and a document identifier if available. Do not send passwords or bank details. Where necessary, the operator will clarify information to verify the applicant's authority.

You have the right to know whether your personal data is held, the purposes, sources and methods of collection and processing, the data held and retention periods; to request correction, blocking or destruction where the relevant grounds exist; to withdraw consent; and to require unlawful processing to stop. The operator's acts or omissions may be challenged before the competent authority or a court. Information relating to the data subject, or a reasoned refusal, is provided within three working days of receipt of the relevant request. Following withdrawal of consent, processing stops within fifteen working days unless retention or processing is required by the legislation of the Republic of Kazakhstan, or a reasoned refusal is provided. Other requests are subject to the applicable statutory deadlines. Mandatory retention and other applicable grounds are assessed separately; any refusal must be reasoned.