CONSENT TO THE CROSS-BORDER TRANSFER OF PERSONAL DATA

Name: ИП «QG Consulting»

Surname, given name: Баймагамбетова Эльмира

Registration number: KZ21UWQ02673326

Registering body: State Revenue Department for Medeu District

Address: 124 Aimanov Street, office 507, Almaty, Republic of Kazakhstan

Telephone: +7 (747) 403-73-53

Email: info@myedline.com

Working hours: The Platform is available 24/7. Enquiries are handled on working days from 10:00 to 19:00 (UTC+5).

Platform: Edline (myedline.com)

This consent is given by the natural person registering on the Edline Platform (the "Subject"), or by their legal representative for persons aged between 14 and 18.

3.1. Users' personal data is subject to cross-border transfer.

3.2. A cross-border transfer is a transfer of personal data to the territory of a foreign state.

3.3. Certain categories of personal data may be transferred to third-party services whose servers are located outside the Republic of Kazakhstan.

• Personal data may be transferred to the following recipients outside the Republic of Kazakhstan:

4.1. OpenRouter, Inc. (USA)

Country: United States of America.

Purpose of transfer: routing requests to artificial intelligence models in order to provide the "Edline Intelligence" tools.

Categories of data: the essay text, the names and levels of activities, academic indicators.

Level of protection: the transfer is made over secure channels using encryption, on the basis of the recipient's commercial data processing terms. The United States of America is not among the states recognised as providing protection of personal data within the meaning of Article 16 of the Law on Personal Data; the transfer is made on the basis of this consent.

4.2. Anthropic PBC (USA), Google LLC (USA)

Country: United States of America.

Purpose of transfer: providing artificial intelligence models and producing the result (essay reviews, profile assessments, explanations accompanying the application report).

Categories of data: the same as those listed in paragraph 4.1.

Level of protection: as in paragraph 4.1. The data transferred is not used to train models.

The Operator has additionally identified the model providers to whom data may be transferred in future: OpenAI, L.L.C. (USA). As at the date this consent is given, no transfer to those providers takes place. The User will be notified at least 14 calendar days before any transfer to a new provider begins.

4.3. Google LLC

Country: United States of America / European Union

Purpose of transfer: user authentication (Google OAuth), analytics of use of the Platform (Google Analytics)

Categories of data: email address (OAuth); technical data in anonymised form (Analytics)

Level of protection: Google LLC adheres to the EU-U.S. Data Privacy Framework and applies Standard Contractual Clauses for data transfers

4.4. Meta Platforms Inc.

Country: United States of America / European Union

Purpose of transfer: analytics of advertising campaign performance (Meta Pixel)

Categories of data: technical data in anonymised form

Level of protection: Meta Platforms Inc. adheres to the EU-U.S. Data Privacy Framework and applies Standard Contractual Clauses

4.5. Namecheap Inc.

Country: United States of America

Purpose of transfer: provision of an email service (the Platform's email correspondence with Users)

Categories of data: the content of email correspondence, email addresses

Level of protection: Namecheap Inc. applies data protection measures in accordance with industry standards

Users' personal data is accumulated and stored in a database located on server infrastructure within the territory of the Republic of Kazakhstan. Backup copies of personal data are also stored within the territory of the Republic of Kazakhstan. The Operator does not store personal data outside the territory of the Republic of Kazakhstan.

Only part of the personal data is subject to cross-border transfer. Transferred: the essay text, the wording of the assignment, the name of the chosen university, the names and levels of activities and achievements, academic indicators (grade point average, test results, fields of study); when other services are used — the email address (authentication), anonymised technical data (analytics), the content of correspondence (email).

Not transferred: surname and given name, date of birth, the account identifier on the Platform, information about the family's financial situation, documents uploaded by the User, and bank card data.

7.1. The Operator applies the following measures to protect personal data during cross-border transfer:

• encryption of data in transit (SSL/TLS);
• transfer only to recipients providing an adequate level of protection of personal data;
• storage of the database within the territory of the Republic of Kazakhstan;
• restriction of access to personal data;

use of secure data transmission channels.

8.1. This consent covers the cross-border transfer of personal data to all recipients listed in paragraph 4 of this document, for the purposes stated in the relevant sections.

8.2. This consent remains in force for the entire period during which the Subject uses the Platform (until the account is deleted or the consent is withdrawn).

8.3. If new recipients of personal data outside the Republic of Kazakhstan are added, the Operator will notify the Subject and, where necessary, request fresh consent.

9.1. The Subject (or their legal representative) may withdraw this consent at any time:

by deleting the account through the Platform's settings; or

by sending a written request to info@myedline.com.

9.2. Important: withdrawing consent to cross-border transfer may make further use of the Platform impossible.

• the Subject's account is subject to deletion;
• all personal data is deleted;

access to the Platform ceases.

9.3. Withdrawal of consent does not affect the lawfulness of cross-border transfers carried out before the withdrawal.

9.4. Withdrawal does not extend to data whose retention is required by the legislation of the Republic of Kazakhstan (payment data — 5 years, consent records — 3 years).

• Under the Law on Personal Data, the Subject has the right to:
• obtain information about the cross-border transfer of their personal data, including the list of recipients and the countries of transfer;
• require the cross-border transfer to cease (by withdrawing this consent);
• require the deletion of personal data transferred outside the Republic of Kazakhstan;

challenge the Operator's actions before the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan or in court.

To exercise these rights the Subject sends a request to info@myedline.com.

This consent and the Consent to the Processing of Personal Data are given by a single checkbox on the registration form. The text of the checkbox:

☐ I consent to the collection and processing of my personal data by the Operator — IE «QG Consulting» — in accordance with the Privacy Policy, the Consent to the Processing of Personal Data — including processing using artificial intelligence systems and the collection of anonymised information about use of the Platform — and the Consent to Cross-Border Transfer of Personal Data.