Privacy Policy - SecondBook

1. General Provisions

1.1. Data Controller

The data controller is Ilnur Stybayev, an independent individual developer (not a legal entity) (hereinafter referred to as "Company", "Operator", "we", "us" — in all cases meaning this independent developer). 2ndBook is a non-commercial tool that lets users find and contact each other directly. The operator is not a party to any transaction between users, does not hold, transfer or retain funds, and charges no commission. Data protection contact: support@secondbook.kz.

1.2. Applicable Law

Personal data processing is carried out in accordance with:

• Law of the Republic of Kazakhstan "On Personal Data and Their Protection" dated May 21, 2013 No. 94-V;
• General Data Protection Regulation (GDPR) — for users from the European Union;
• Other applicable regulatory legal acts.

1.3. Consent to Data Processing

By registering with SecondBook or using our service, you consent to the collection and processing of personal data under the terms set forth in this Policy. You may withdraw your consent at any time.

2. What Data We Collect

2.1. Data You Provide

2.2. Data Collected Automatically

2.3. Data from Other Sources

We may receive data from the following sources:

• Social Networks: when logging in via Google, Apple, or Telegram — name, email, profile photo;
• Other Users: reviews and ratings about you.

3. Purposes of Personal Data Processing

We process your personal data for the following purposes:

3.1. Contract Performance

• Creating and managing your account;
• Processing listings and transactions;
• Facilitating communication between users;
• Coordinating delivery of physical books between users.

3.2. Legitimate Interests

• Ensuring platform and user security;
• Preventing fraud;
• Improving service quality;
• Usage analytics and statistics;
• Technical support for users.

3.3. With Your Consent

• Sending marketing messages and promotions;
• Personalized advertising;
• Participation in research and surveys;
• Real-time geolocation processing.

3.4. Legal Requirements

• Responding to government authority requests;
• Compliance with tax legislation;
• Protecting rights in legal proceedings.

4. Sharing Data with Third Parties

4.1. Categories of Recipients

We may share your data with the following categories of recipients:

4.2. Cross-Border Data Transfer

Your data may be transferred to and stored on servers outside the Republic of Kazakhstan. In such transfers, we ensure an adequate level of data protection in accordance with legal requirements.

4.3. We Do NOT Sell Your Data

We do not sell users' personal data to third parties for their marketing purposes.

5. Data Storage and Protection

5.1. Retention Periods

5.2. Security Measures

We apply the following measures to protect your data:

• Encryption: SSL/TLS for data transmission, encryption at rest;
• Access Control: data access limited to authorized personnel only;
• Monitoring: intrusion detection systems and suspicious activity monitoring;
• Backup: regular creation of secure backup copies;
• Staff Training: regular training of employees on data handling rules;
• Security Audit: periodic security system reviews.

5.3. Incident Notification

In the event of a data breach that may pose risks to your rights and freedoms, we will notify you and the relevant government authorities within 72 hours of discovering the incident.

6. Your Rights

6.1. Right of Access

You have the right to obtain confirmation of whether we process your data, as well as to receive a copy of your personal data.

6.2. Right to Rectification

You have the right to request correction of inaccurate or incomplete data about you.

6.3. Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data if:

• The data is no longer necessary for the purposes for which it was collected;
• You withdraw your consent to processing;
• The data was processed unlawfully.

6.4. Right to Restriction of Processing

You have the right to request restriction of processing of your data in certain cases.

6.5. Right to Data Portability

You have the right to receive your data in a structured, machine-readable format and transfer it to another controller.

6.6. Right to Object

You have the right to object to the processing of your data for direct marketing purposes at any time.

6.7. Right to Withdraw Consent

If processing is based on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

6.8. Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority for personal data protection if you believe your rights have been violated.

6.9. How to Exercise Your Rights

To exercise your rights, you may:

• Use settings in your profile;
• Contact support: support@secondbook.kz;
• Send a written request to the Company's address.

We will respond to your request within 30 calendar days.

7. Cookies and Similar Technologies

7.1. What Are Cookies

Cookies are small text files that are stored on your device when you visit a website.

7.2. Types of Cookies We Use

7.3. Managing Cookies

You can manage cookies through:

• Your browser settings;
• Cookie consent banner on first visit;
• Privacy settings in your profile.

Disabling some cookies may affect service functionality.

8. Children

SecondBook is not intended for children under 14 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with their data, please contact us and we will delete this information.

Users aged 14 to 18 may use the service with the consent of parents or legal guardians.

9. Changes to the Policy

9.1. Amendment Procedure

We may update this Policy. We will notify you of material changes at least 30 days before they take effect.

9.2. Version History

Previous versions of the Policy are available upon request.

10. Additional Information for EU Users (GDPR)

If you are located in the European Union, additional rights and guarantees under GDPR apply to you:

10.1. Legal Bases for Processing

• Article 6(1)(a): consent — for marketing communications;
• Article 6(1)(b): contract performance — for providing services;
• Article 6(1)(c): legal obligations — for legal compliance;
• Article 6(1)(f): legitimate interests — for security and service improvement.

10.2. EU Representative

If you have questions regarding data processing under GDPR, contact us at: support@secondbook.kz

© 2026 SecondBook. All rights reserved.