CONSENT TO THE COLLECTION AND PROCESSING OF PERSONAL DATA

Name: ИП «QG Consulting»

Surname, given name: Баймагамбетова Эльмира

Registration number: KZ21UWQ02673326

Registering body: State Revenue Department for Medeu District

Address: 124 Aimanov Street, office 507, Almaty, Republic of Kazakhstan

Telephone: +7 (747) 403-73-53

Email: info@myedline.com

Working hours: The Platform is available 24/7. Enquiries are handled on working days from 10:00 to 19:00 (UTC+5).

Platform: Edline (myedline.com)

This consent is given by the natural person registering on the Edline Platform (the "Subject"), or by their legal representative for persons aged between 14 and 18.

3.1. Data provided on registration:

• surname, given name;
• email address;
• password (stored in encrypted form);

date of birth.

3.2. Data provided voluntarily while using the Platform:

• GPA (grade point average);
• standardised test results (SAT, IELTS, TOEFL and others);
• intended fields of study;
• information about the need for financial aid;
• information about the family's financial situation (the family's annual contribution to tuition);
• information about extracurricular activities, achievements and awards;
• answers to the questionnaire during initial profile setup;

the list of universities of interest.

Information about academic performance (GPA, grades) and test results is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

Information about extracurricular activities, achievements and awards is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

Information about the family's financial situation is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

Answers to the questionnaire during initial profile setup is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

3.3. User content:

• notes, tasks, calendar entries;
• essay texts;
• university lists;

other personal materials created in the Open Space section.

3.4. Technical data (collected automatically):

• IP address;
• browser type and version;
• device type and operating system;
• date, time and duration of the visit;

pages viewed and actions taken on the Platform.

3.5. The following are additionally processed: information about activities, achievements and awards; answers to the questionnaire (onboarding); information about the family's financial situation; documents uploaded by the User; the outputs of artificial intelligence systems; technical information about the use of artificial intelligence systems.

3.6. Providing information about the grade point average, test results, fields of study, activities, achievements, the family's financial situation and the questionnaire answers is voluntary. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

3.7. Anonymised information about use of the Platform. With the User's consent, given through the cookie banner, the Operator, where an external web analytics service is connected, collects anonymised statistics on use of the Platform: pages visited, referring source, device and browser type, and session duration. As at the date of this edition no such service is connected and no collection takes place. This information is used solely to assess traffic and improve the Platform and is not used to identify the User. No collection takes place without the consent given in the banner. The recipients of such information and the conditions of cross-border transfer are set out in the Consent to Cross-Border Transfer of Personal Data.

• Personal data is collected and processed for the following purposes:
• creating and managing the Subject's account on the Platform;
• providing the Platform's functionality (data storage, display, synchronisation);
• enabling shared access (collaboration) at the Subject's initiative;
• processing payments for the Premium subscription (transferring the name and email to the payment provider);
• ensuring the security of the Platform and preventing fraud;
• analysing use of the Platform and improving the quality of the service;
• sending service notifications relating to the operation of the account;

complying with the requirements of the legislation of the Republic of Kazakhstan.

• providing the "Edline Intelligence" tools (essay review, profile assessment, application report), including automated processing of personal data by artificial intelligence systems;
• monitoring compliance with the usage limits for those tools and preventing abuse.

The Subject consents to the following operations on personal data: collection, recording, systematisation, accumulation, storage, updating (renewal, amendment), retrieval, use, transfer (disclosure) to the third parties listed in paragraph 6, anonymisation, blocking, deletion and destruction.

…and also automated processing of personal data, including by means of artificial intelligence systems.

• Personal data may be transferred to the following third parties:
• OpenRouter, Inc. (USA) — routing of requests to artificial intelligence models;
• Anthropic PBC (USA), Google LLC (USA) — producing the essay review, the profile assessment and the application report;
• OpenAI, L.L.C. (USA) — the same purposes; not in use as at the date of publication;
• Paylink (paylink.kz, Kazakhstan) — payment provider, payment processing (name and email are transferred);
• Google LLC (USA / EU) — authentication (Google OAuth), analytics (Google Analytics);
• Meta Platforms Inc. (USA / EU) — advertising campaign analytics (Meta Pixel);

Namecheap Inc. (USA) — email service.

Personal data is transferred to state bodies of the Republic of Kazakhstan only in the cases provided for by law.

• OpenRouter, Inc. (USA) (United States of America) — routing of requests to artificial intelligence models;
• Anthropic PBC (USA), Google LLC (USA) (United States of America) — provision of artificial intelligence models and production of the result;
• OpenAI, L.L.C. (USA) (United States of America) — model providers to whom data may be transferred in future; as at the date this consent is given, no transfer to them takes place.

Transferred: the essay text, the names and levels of activities, academic indicators. Not transferred: surname and given name, email address, date of birth, account identifier, information about the family's financial situation, uploaded documents and payment data.

Users' personal data is accumulated and stored in a database located on server infrastructure within the territory of the Republic of Kazakhstan. Backup copies of personal data are also stored within the territory of the Republic of Kazakhstan. The Operator does not store personal data outside the territory of the Republic of Kazakhstan.

8.1. This consent remains in force for the entire period during which the Subject uses the Platform (until the account is deleted or the consent is withdrawn).

8.2. Personal data retention periods:

• account data — for the whole life of the account plus 30 days after deletion;
• profile data and user content — until the account is deleted;
• technical data — 12 months from collection;
• payment data — 5 years (tax legislation of the Republic of Kazakhstan);

consent records — 3 years after the consent is withdrawn or the account is deleted.

• outputs of artificial intelligence systems — until deleted by the User or until the account is deleted;
• technical information about the use of artificial intelligence systems — 12 months;
• the text of requests sent to artificial intelligence models — not stored.

9.1. The Subject (or their legal representative) may withdraw this consent at any time:

by deleting the account through the Platform's settings; or

by sending a written request to info@myedline.com.

9.2. Withdrawal of consent results in the cessation of processing of personal data, deletion of the account and termination of access to the Platform.

9.3. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9.4. Withdrawal does not extend to data whose retention is required by the legislation of the Republic of Kazakhstan.

• Under the Law on Personal Data, the Subject has the right to:
• obtain information about the processing of their personal data;
• require inaccurate data to be corrected;
• require personal data to be deleted;
• require data to be blocked (processing restricted);
• withdraw this consent;

challenge the Operator's actions before the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan or in court.

To exercise these rights the Subject sends a request to info@myedline.com.

This consent and the Consent to Cross-Border Transfer of Personal Data are given by a single checkbox on the registration form. The text of the checkbox:

☐ I consent to the collection and processing of my personal data by the Operator — IE «QG Consulting» — in accordance with the Privacy Policy, the Consent to the Processing of Personal Data — including processing using artificial intelligence systems and the collection of anonymised information about use of the Platform — and the Consent to Cross-Border Transfer of Personal Data.

Rights in relation to automated processing of personal data. The Subject has the right to: learn that a result was produced by an artificial intelligence system; obtain a clear explanation of the result and information about the data it was based on; object to a result and require it to be reviewed by a human; refuse to interact with artificial intelligence systems entirely. An objection is considered within 3 working days of receipt. The procedure is set out in the AI Use Policy.