Политика конфиденциальности

Draft — legal review required. This text has been adapted for the Kyrgyz Republic and has not yet been reviewed by a qualified lawyer. Statutory references below must be confirmed before launch.

1. Who we are

KGZ Apartments ("the Platform", "we", "us", or "our") is an online real estate discovery and listing service focused on Bishkek and other cities of the Kyrgyz Republic. We are the data controller responsible for personal information collected through kgzapartments.com and related services.

Contact: support@kgzapartments.com — Bishkek, Kyrgyzstan.

This policy explains what personal data we collect, why we collect it, how long we keep it, and your rights under the Law of the Kyrgyz Republic "On Personal Information" and, where relevant, the EU General Data Protection Regulation (GDPR) for users accessing the platform internationally.

2. Information we collect

Information you provide directly

• Account data: full name, email address, phone number, and password (stored as a cryptographic hash) when you register.
• Listing data: property address, photos, description, price, availability, and other content you submit.
• Inquiry and messaging data: text content of messages sent to property owners or our support team.
• Payment data: subscription plan selection and transaction references. Actual card or banking details are handled by our payment processor; we do not store raw payment credentials.
• Support communications: any information you include when contacting us by email, the contact form, or otherwise.

Information we collect automatically

• Log data: IP address, browser type, operating system, pages visited, timestamps, and referring URLs.
• Device data: device identifiers, screen resolution, and language settings.
• Location data: approximate geographic region derived from IP address. We do not collect precise GPS coordinates unless you explicitly grant device-level permission.
• Usage data: listings viewed, search filters used, clicks, and session duration — used to improve platform performance and relevance.

Information from third parties

• Authentication providers: if you log in via a supported third-party identity provider, we receive your name and email address as shared by that provider under their own privacy terms.
• Payment processors: we receive confirmation of payment status; we do not receive full card details.

3. Legal basis for processing

For users to whom GDPR or equivalent data-protection rules apply, we rely on the following legal bases:

| Processing purpose | Legal basis | |---|---| | Account creation and login | Performance of a contract | | Publishing your listings to prospective renters or buyers | Performance of a contract | | Sending service emails (receipts, security alerts) | Performance of a contract | | Fraud prevention and security monitoring | Legitimate interests (platform and user security) | | Analytics and platform improvement | Legitimate interests (balanced against minimal data use) | | Marketing emails and promotional communications | Consent (you may withdraw at any time) | | Complying with legal or regulatory obligations | Legal obligation |

For users in Kyrgyzstan, we process data in accordance with the Law of the Kyrgyz Republic "On Personal Information" and the law of the Kyrgyz Republic on electronic documents and electronic signatures.

4. How we use your information

We use the information collected to:

• Create and manage your account and session;
• Publish and display your listings to other platform users;
• Facilitate inquiries and messages between users;
• Process subscription payments and issue receipts;
• Detect, investigate, and prevent fraud, spam, and abuse;
• Enforce our Terms of Use and comply with applicable law;
• Respond to your support requests;
• Send transactional and service-related notifications;
• Send promotional communications where you have given consent or where otherwise permitted by law;
• Measure platform performance and improve features through aggregated, anonymised analytics;
• Comply with lawful requests from government or regulatory authorities.

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Cookies and similar technologies

We use cookies and similar tracking technologies to operate and improve the platform. Please see our Cookie Policy for full details of which cookies we use, their purpose, and how to manage them.

In summary:

• Strictly necessary cookies keep you logged in and make core features work. They cannot be switched off.
• Functional cookies remember your preferences (such as theme or saved filters).
• Analytics cookies help us understand aggregate usage patterns without identifying individuals. These require your consent and can be declined.

6. Sharing and disclosure

We do not sell your personal information.

We may share data with:

• Service providers — hosting, email delivery, payment processing, and analytics partners — under contracts that restrict them to processing data only on our behalf;
• Other users — to the extent necessary to facilitate an inquiry (e.g. your display name and contact details when you message a listing owner, or when an owner follows up on your inquiry);
• Law enforcement or regulatory bodies — when required by law, court order, or to protect the rights, property, or safety of our users or the public;
• Successors — if KGZ Apartments is acquired or merged with another entity. We will notify registered users before personal data transfers to a new controller with a different privacy policy.

7. International data transfers

Our primary operations are based in Kyrgyzstan. Some service providers operate infrastructure outside Kyrgyzstan. Where personal data is transferred internationally, we take steps to ensure appropriate safeguards are in place — such as standard contractual clauses recognised under applicable law, or transfers to jurisdictions with an adequate level of protection.

8. Data retention

We retain personal data only as long as necessary for the purposes described, or as required by law:

| Data category | Retention period | |---|---| | Account data | Duration of account + 3 years after closure | | Listing and inquiry data | 2 years after listing closure or removal | | Payment and transaction records | 7 years (financial and tax compliance) | | Log and security data | Up to 12 months | | Marketing consent records | Until consent withdrawn + reasonable compliance period |

9. Your rights

Depending on your location and applicable law, you may have the following rights. To exercise any right, email support@kgzapartments.com with a description of your request. We will respond within 30 days and may ask for identity verification before processing.

• Access — request a copy of personal data we hold about you.
• Correction — request that inaccurate or incomplete data be corrected.
• Erasure — request deletion of your personal data where we have no lawful basis to retain it.
• Restriction — request that we limit how we use your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format (applies to data processed on a contract or consent basis by automated means).
• Objection — object to processing based on our legitimate interests or for direct marketing at any time.
• Withdrawal of consent — withdraw consent for any processing you previously agreed to; this does not affect the lawfulness of prior processing.

Complaints. If you are dissatisfied with our response, you may lodge a complaint with the authorised state body for personal data protection of the Kyrgyz Republic or, if you are in the EU, your national data-protection supervisory authority.

10. Security

We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS), hashed and salted password storage, access controls limited to authorised personnel, and regular security reviews.

No method of internet transmission is completely secure. You are responsible for keeping your credentials confidential and for all activity under your account. Report suspected security vulnerabilities to support@kgzapartments.com.

11. Children's privacy

Our services are not directed at persons under 16 years of age (or the minimum contractual-capacity age under applicable law). We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

12. Changes to this policy

We may update this policy periodically. When we do, we will update the "Last updated" date on this page. For material changes that significantly affect how we use your personal data, we will provide additional notice — for example, via email or a platform notice — where required by law. Continued use of the Platform after a policy update constitutes acceptance of the revised policy.

13. Contact us

Email: support@kgzapartments.com Contact form: kgzapartments.com/contact Address: Bishkek, Kyrgyzstan

We aim to respond to all privacy-related requests within 30 days.