GDPR Compliance — SecondBook

1. Introduction

SecondBook is committed to protecting the personal data of all users, including residents of the European Union and the European Economic Area (EEA). This document supplements our Privacy Policy and describes specific measures for GDPR compliance.

1.1. Who We Are

Data Controller: Ilnur Stybayev, an independent individual developer (not a legal entity).

2ndBook is a non-commercial tool that lets users find and contact each other directly. The operator is not a party to any transaction between users, does not hold, transfer or retain funds, and charges no commission.

Email for GDPR Requests: support@secondbook.kz

General Email: support@secondbook.kz

1.2. Scope of Application

The provisions of this document apply to:

• Users located in the EU/EEA;
• EU citizens, regardless of their current location;
• Processing of data related to offering goods or services to persons in the EU;
• Monitoring the behavior of users in the EU.

2. Legal Bases for Data Processing

In accordance with Article 6 of the GDPR, we process your personal data on the following legal bases:

3. Your Rights Under GDPR

3.1. Right to Information (Articles 13-14)

You have the right to know what data we collect, why, and how we use it. This information is provided in this document and the Privacy Policy.

3.2. Right of Access (Article 15)

You may request:

• Confirmation of whether we process your data;
• A copy of all your personal data;
• Information about processing purposes, data categories, recipients;
• Expected data retention period.

Response Time: 30 days (with possible extension of 60 days for complex requests).

3.3. Right to Rectification (Article 16)

You may request correction of inaccurate data or completion of incomplete data. You can also update your data yourself in profile settings.

3.4. Right to Erasure ("Right to Be Forgotten") (Article 17)

You may request deletion of your data if:

• Data is no longer necessary for its original purposes;
• You withdraw consent (if processing is based on consent);
• You object to processing;
• Data was processed unlawfully;
• Deletion is required for legal compliance.

Exceptions: We may refuse deletion if data is necessary for fulfilling legal obligations or defending legal claims.

3.5. Right to Restriction of Processing (Article 18)

You may request restricted processing if:

• You contest data accuracy;
• Processing is unlawful, but you don't want deletion;
• We no longer need the data, but you need it for legal claims;
• You have objected to processing.

3.6. Right to Data Portability (Article 20)

You may receive your data in a structured, machine-readable format (JSON, CSV) and transfer it to another controller. This right applies to data that:

• You provided to us;
• Is processed based on consent or contract;
• Is processed by automated means.

3.7. Right to Object (Article 21)

You have the right to object to:

• Direct marketing: absolute right, we will cease processing immediately;
• Processing based on legitimate interests: we will consider your grounds.

3.8. Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which have legal or similarly significant effects.

Note: SecondBook does not use fully automated decision-making with legal consequences without human involvement.

3.9. Right to Withdraw Consent (Article 7(3))

If processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

3.10. Right to Lodge a Complaint (Article 77)

You have the right to file a complaint with a data protection supervisory authority. For EU residents, this is the authority in your country of residence, work, or alleged violation.

4. How to Exercise Your Rights

4.1. Methods of Submitting Requests

• Email: support@secondbook.kz
• Through the app: Settings → Privacy → My Data
• In writing: to the Company address

4.2. Identity Verification

To protect your data, we may request identity confirmation before fulfilling a request. This may include:

• Email address confirmation;
• Answers to security questions;
• In exceptional cases — a copy of an identity document.

4.3. Response Times

4.4. Cost

Exercising your rights is free. We may charge a reasonable fee or refuse to act only for manifestly unfounded or excessive requests (e.g., repeated requests).

5. International Data Transfers

5.1. Cross-Border Transfer

Your data may be transferred outside the EEA for storage and processing. We ensure data protection through the following mechanisms:

5.2. Standard Contractual Clauses

We use Standard Contractual Clauses approved by the European Commission for data transfers to countries without an adequacy decision.

6. Data Protection by Design and by Default

In accordance with Article 25 of the GDPR, we implement the following principles:

6.1. Privacy by Design

• Data minimization — we collect only necessary data;
Pseudonymization and encryption — where possible;
• Data separation — logical separation of user data;
• Secure architecture — design with security in mind.

6.2. Privacy by Default

• Minimal privacy settings by default;
• Opt-in for marketing communications;
• Limited profile access for new users;
• Automatic deletion of inactive data.

7. Breach Notification

7.1. Notification to Supervisory Authority (Article 33)

In the event of a personal data breach that may pose a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours.

7.2. Notification to Data Subject (Article 34)

If the breach may result in a high risk to your rights and freedoms, we will notify you without undue delay, indicating:

• Nature of the breach;
• Likely consequences;
• Measures taken;
• Contact for obtaining information.

8. Data Protection Impact Assessment (DPIA)

In accordance with Article 35 of the GDPR, we conduct data protection impact assessments before implementing processing operations that may pose a high risk to the rights of data subjects, including:

• Systematic processing of sensitive data;
• Large-scale monitoring of public areas;
• Automated decision-making with legal consequences;
• New data processing technologies.

9. EU Representative

In accordance with Article 27 of the GDPR, if you wish to contact our EU representative or have questions about GDPR, please write:

Email: support@secondbook.kz

We will consider appointing an official EU representative as our presence in the European market expands.

10. Cookies and Tracking

For EU users, we provide:

• Cookie consent banner: with detailed category selection;
• Withdrawal option: at any time through settings;
• Operation without cookies: core functionality available without non-essential cookies.

Cookie Categories:

11. Document Changes

We may update this document. We will notify you of significant changes by email at least 30 days before the changes take effect.

© 2026 SecondBook. All rights reserved.
Document updated: June 4, 2026 | Version: 1.0 | GDPR Compliance