Privacy

Effective Date: August 28, 2026
Document Version: 1.0

Section 1. General Provisions and Data Controllers

1.1. Document Purpose

This Privacy Policy (hereinafter referred to as the "Policy") establishes the procedure for collection, processing, storage, use, transfer, and protection of personal data of users of the official ValQayum project platform and participants of esports tournaments in the discipline of VALORANT conducted within this project.

This Policy is developed in accordance with:

• Law of the Republic of Kazakhstan "On Personal Data and Their Protection" dated May 21, 2013 No. 94-V (hereinafter referred to as the "RK Law on Personal Data");

• Federal Law of the Russian Federation "On Personal Data" dated July 27, 2006 No. 152-FZ (hereinafter referred to as "152-FZ");

• General Data Protection Regulation of the European Union (General Data Protection Regulation, GDPR), Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter referred to as "GDPR"), in the part applicable to data subjects located in the territory of the European Union.

1.2. Personal Data Controllers

Personal data controllers within ValQayum project are tournament organizers (hereinafter referred to as the "Controllers", "We"):

• Ken

• AVS

The Controllers act as private individuals, are not legal entities, and process personal data exclusively for the purposes of organizing and conducting amateur esports tournaments in VALORANT game.

Controllers' Contact Information for Personal Data Protection Inquiries:

• official email address (published on ValQayum project website);

• ValQayum project Discord server;

• ValQayum project Telegram channel.

1.3. Policy Applicability

This Policy applies to all users and participants who:

• visit the official ValQayum project website;

• register to participate in tournaments;

• interact with Controllers through official communication channels (Discord, Telegram);

• provide their personal data in any other way within ValQayum project.

By using the website, registering to participate in a tournament, or providing personal data in any other way, the user confirms their agreement with this Privacy Policy.

1.4. Terms and Definitions

Personal Data — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).

Personal Data Processing — any action (operation) or set of actions (operations) performed using automation tools or without their use, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

Personal Data Subject (Data Subject) — a natural person whose personal data is processed by Controllers.

Personal Data Subject Consent — a voluntary, specific, informed, and conscious expression of will of personal data subject by which they authorize processing of their personal data.

Cross-border Transfer of Personal Data — transfer of personal data to territory of foreign state to authority of foreign state, foreign natural person, or foreign legal entity.

Section 2. Legal Grounds for Processing

2.1. Grounds for Personal Data Processing

Personal data processing within ValQayum project is carried out on the following legal grounds:

a) Data Subject Consent (Art. 6(1)(a) GDPR, Art. 8 RK Law on Personal Data, Art. 9 152-FZ): User explicitly expresses their consent to personal data processing by:

• accepting this Privacy Policy when registering for tournament;

• filling out registration form and submitting participation application;

• performing other conclusive actions indicating consent to data processing.

b) Contract Performance (Art. 6(1)(b) GDPR): Personal data processing is necessary for performance of contract (in this case — Terms of Tournament Participation accepted by user) to which data subject is party, or to take steps at data subject's request prior to entering into contract.

c) Controllers' Legitimate Interests (Art. 6(1)(f) GDPR): Personal data processing is necessary for purposes of Controllers' legitimate interests, including:

• ensuring competition integrity (combating smurfing, cheating);

• protecting rights and legitimate interests of Controllers and other participants;

• ensuring platform security and preventing fraud;

• analyzing and improving tournament quality.

While interests or fundamental rights and freedoms of data subject do not override these legitimate interests.

2.2. Consent for Processing Minor Personal Data

Processing personal data of persons aged 14 to 18 is carried out based on:

• consent of minor themselves;

• additional written consent of parent (legal guardian) of minor in accordance with requirements of Law of Republic of Kazakhstan "On Rights of Child in Republic of Kazakhstan" dated August 8, 2002 No. 345-II and Art. 9 RK Law on Personal Data.

Processing personal data of persons under 14 years is not carried out, as participation in ValQayum project tournaments is allowed only to persons who have reached age 14.

2.3. Consent Voluntariness and Right to Withdrawal

Consent to personal data processing is voluntary. User has right not to provide their personal data, but in this case participation in ValQayum project tournaments becomes impossible.

User has right at any time to withdraw their consent to personal data processing by submitting corresponding request to Controllers. Consent withdrawal does not affect lawfulness of personal data processing carried out before consent withdrawal.

Upon consent withdrawal, Controllers cease processing user's personal data and delete it in procedure established by Section 8 of this Policy, except when data retention is required by legislation.

Section 3. Categories of Collected Data

3.1. Personal Data Collected During Tournament Registration

For tournament registration and competition participation, Controllers collect following categories of personal data:

a) Identification and Contact Data:

• the Discord nickname supplied by the participant in the application;

• the Telegram username (format @username);

• the Riot ID — the game account identifier (format Nickname#TAG);

• the date of birth supplied by the participant when applying.

Data received from Discord when signing in to the personal cabinet:

Signing in to the personal cabinet is done through a Discord account. Discord passes the Controllers:

• the Discord account identifier — a permanent numeric value that does not change when the nickname changes;

• the username and the display name;

• links to profile imagery: avatar, banner and accent colour, where the participant has set them.

This is used to sign in, to attach the application to the account and to render the cabinet. The Controllers do not request access to the email address, messages, server list or any other account data: the only scope requested is identify. The Discord access token is not retained once this information has been obtained.

The date of birth is collected to verify the age requirement (Terms of Participation, section 3) and to determine whether a legal guardian's consent is required (section 4). Identity documents of the participant are neither requested nor stored.

b) Game Data:

• the current VALORANT rank declared by the participant when submitting the application;

• a link to the participant's public profile on the tracker.gg platform.

Historical match statistics, performance indicators (K/D, average damage per round, win rate) and match history are neither collected nor stored by the Controllers.

c) Organizational Data:

• the team the participant is assigned to during automatic team building, and the captain flag;

• the application status and internal moderator notes.

d) Technical Data:

• the IP address the application was submitted from. It is recorded only at the moment the form is submitted and is used solely to limit the number of applications and to protect against automated submissions.

The Controllers do not collect browser and operating system information (User-Agent), referrer, the list of pages viewed, and do not perform behavioural analytics on visitors.

e) Payment Data:

• the payer name supplied by the participant so an incoming transfer can be matched;

• a screenshot of the entry fee payment receipt, if the participant uploaded one.

The Controllers do NOT collect or store bank card numbers (including the last digits), CVV codes, PIN codes, the payer's banking details or any other sensitive payment data. An uploaded receipt is not parsed automatically.

f) Legal guardian's consent (participants under 18 only):

• a scan or photograph of the signed consent, uploaded by the participant.

The document contains the details of the parent or legal guardian as they filled them in on the form. It is held in private storage, is accessible to the Controllers only through a temporary signed link, and is deleted together with the participant's application within the periods set out in section 8 of this Policy.

No email address is requested at registration.

3.2. Automatically Collected Data

The ValQayum application does not perform its own collection of visitors' technical data: there are no analytics, visit counters or advertising trackers on the site. An IP address is written to the database only at the moment an application form is submitted (see clause 3.1 "d").

Separately from this, the hosting provider (Vercel Inc.) and the automated-request protection service (Cloudflare, Inc.) keep their own technical server logs, which record the IP address, User-Agent and the requested page address. Those logs are produced on the side of those providers as part of keeping the service operational and secure, are not handed to the Controllers as a separate database, and are not stored in the Tournament database. Retention periods for such logs are determined by the respective providers' policies.

3.3. Data Obtained from Third-party Sources

The Controllers do not obtain users' personal data from third-party sources automatically.

The link to the public tracker.gg profile that the participant supplies in the application is opened manually by a moderator for a visual check of the declared rank. No data from that page is downloaded, stored or transferred into the Controllers' database.

3.4. Data We DO NOT Collect

Controllers do not collect following categories of personal data:

• passport data, identity document numbers (except when requesting parental consent for minors);

• racial or ethnic origin data;

• political views, religious or philosophical beliefs data;

• trade union membership data;

• genetic and biometric data;

• health data;

• sexual life or sexual orientation data.

Section 4. Processing Purposes and Transparent Auto-balancing Algorithm

4.1. Personal Data Processing Purposes

User personal data is processed by Controllers exclusively for following purposes:

a) Tournament Organization and Conduct:

• participant registration for tournaments;

• team (roster) formation using automatic balancing algorithm;

• match conduct and winner determination;

• tournament results and tournament tables publication.

b) Ensuring Competition Integrity:

• smurfing detection and prevention (using additional accounts);

• combating cheating and other forms of unfair play;

• checking participants' compliance with qualification requirements;

• investigating tournament rules violations.

c) Financial Operations:

• accepting organizational fees;

• forming and distributing prize pool;

• paying prize money to winners.

d) Participant Communication:

• sending notifications about tournaments, schedule changes, results;

• responding to user requests;

• reviewing complaints, claims, and appeals.

e) Ensuring Platform Security:

• protecting against unauthorized access, fraud, spam;

• preventing DDoS attacks and other cyber threats;

• ensuring compliance with platform conduct rules.

f) Service Analysis and Improvement:

• analyzing website traffic and user activity;

• improving platform functionality and tournament quality;

• developing new features and services.

4.2. Transparent Automatic Team Balancing Algorithm

Controllers use automated team balancing system to ensure fair participant distribution into teams based on their gaming indicators.

Algorithm Operating Principles:

1. 01

   Data Collection: The system uses the rank the participant declared at registration and which a moderator verified against the open tracker.gg profile.

2. 02

   Balance Coefficient Calculation: Each participant is assigned conditional balance coefficient based on objective indicators: current rank, average damage per round, win percentage, K/D indicator, historical rating dynamics.

3. 03

   Team Distribution: Participants are distributed into teams in such way as to minimize difference in total team strength (algorithm strives for even distribution of total balance coefficients).

4. 04

   Team Formation: Final team compositions are published after registration closes.

Important Guarantees:

• Algorithm does not perform profiling having legal consequences for data subject (within meaning of Art. 22 GDPR). Team balancing does not affect participant's legal status, does not create legal consequences for them, and does not affect their interests in similarly significant way beyond tournament participation.

• Algorithm uses exclusively objective gaming indicators publicly available and does not consider participant's personal characteristics (age, gender, nationality, place of residence, etc.).

• Participant has right to request explanation of algorithm logic and receive information about which indicators were considered when distributing them to team.

4.3. Automated Decision Making

Controllers use automated personal data processing (team balancing algorithm), but this is not automated decision making having legal consequences or similarly significantly affecting data subject interests (Art. 22 GDPR).

Participant distribution into one or another team:

• does not affect participant's legal status;

• does not deprive participant of any rights;

• does not create discriminatory consequences;

• is temporary decision valid only within specific tournament.

While participant has right to challenge algorithm operation results if they believe their data was processed incorrectly, and Controllers undertake to review such appeal in accordance with Section 12 of this Policy.

Section 5. Public Data vs Closed Personal Status Pages

5.1. Public Data

Following data is considered public and may be accessible for viewing by unlimited circle of persons on official ValQayum project website:

a) Team Names: Team names formed for tournament participation are published on website and in official communication channels.

b) Participants' Gaming Nicknames (Optional): Participants' gaming nicknames (Riot ID) may be published in team compositions and tournament tables if necessary for tournament purposes and results transparency.

c) Match Results and Tournament Tables: Match results, team places, game statistics are published in open access.

Publication of specified data is carried out based on participant consent and in accordance with Controllers' legitimate interests in ensuring competition transparency.

5.2. Closed Personal Status Pages

Following data is confidential and accessible only to participant themselves in their personal protected area on platform:

a) Participant Personal Status Page: Each participant has access to closed page containing:

• their participation application status (approved, under moderation, rejected);

• information about paid organizational fee;

• team they are assigned to;

• their match schedule;

• their appeals to Controllers history.

b) Financial Data: Information about organizational fee payment, details for prize money payout and other financial data is accessible only to participant themselves and Controllers.

c) Contact Data: Discord ID, Telegram ID, email address and other participant contact data is not published in open access and is used by Controllers exclusively for participant communication.

5.3. Public Disclosure Minimization Principle

Controllers adhere to public disclosure minimization principle of personal data: only information necessary to ensure competition transparency and inform public about tournament results is published in open access.

Participant has right to request deletion of their public data (gaming nickname, team name) from open materials after tournament completion by submitting corresponding request to Controllers. Controllers undertake to review such request within 14 calendar days.

Section 6. Integration with Third-party Services (tracker.gg)

6.1. Riot Games API Is Not Used

The Controllers do not connect to the Riot Games API and do not automatically obtain data from Riot Games systems. Match history, performance statistics, ban records and other game account data are neither transferred to nor stored by the Controllers.

The only source of information about a participant's skill level is the data the participant supplies in the application themselves (current rank and a link to a public profile), verified visually by a moderator.

6.2. tracker.gg Platform Integration

Controllers use public data from tracker.gg platform (TRN — Tracker Network) to obtain additional participants' gaming statistics.

Data Obtained from tracker.gg:

• public participant game statistics;

• rating indicators;

• historical rating dynamics data.

Use of data from tracker.gg is carried out based on public availability of this data (participant must open their profile for public viewing) and participant consent to data processing within this Policy.

Controllers are not responsible for accuracy and relevance of data provided by tracker.gg platform. In case of inaccuracies detection, participant has right to inform Controllers about it, and data will be corrected.

6.3. Third-party Communication Services (Discord, Telegram)

Controllers use Discord and Telegram platforms for participant communication.

When interacting through Discord and Telegram, privacy policies and data use terms of platforms apply:

• Discord Privacy Policy: https://discord.com/privacy

• Telegram Privacy Policy: https://telegram.org/privacy

Controllers are not responsible for personal data processing by Discord and Telegram platforms. Participant independently decides on using these platforms and bears responsibility for complying with their terms of use.

Controllers process only participant data from Discord and Telegram necessary for tournament registration and communication (Discord ID, Telegram ID, nickname).

Section 7. Cross-border Data Transfer (Supabase, Vercel, Cloudflare)

7.1. Cross-border Transfer Grounds

Within ensuring functioning of official ValQayum project website and storing participants' personal data, Controllers carry out cross-border transfer of personal data to territories of countries not included in European Economic Area (EEA) and not recognized by European Commission as providing adequate level of personal data protection.

Cross-border transfer is carried out in accordance with Art. 44–50 GDPR on following grounds:

• Data subject consent to cross-border transfer after informing about possible risks (Art. 49(1)(a) GDPR);

• Transfer necessity for contract performance between Controllers and data subject (Art. 49(1)(b) GDPR);

• Transfer necessity for Controllers' legitimate interests purposes not overriding data subject rights and freedoms (Art. 49(1) GDPR).

7.2. Countries and Services to Which Data is Transferred

Participants' personal data may be transferred and processed on servers of following third-party services located outside Republic of Kazakhstan and European Economic Area:

a) Supabase (USA):

• Purpose: storing participant data in database (PostgreSQL);

• Transferred data: Discord ID / Telegram ID, Riot ID, rank, statistics, application status;

• Server location: USA and other countries chosen by Supabase Inc.;

• Supabase Privacy Policy: https://supabase.com/privacy

b) Vercel Inc. (USA):

• Purpose: ValQayum project website hosting and user request processing;

• Transferred data: user IP addresses, website visit technical data (User-Agent, referrer);

• Server location: USA, Europe and other regions depending on Vercel Edge Network configuration;

• Vercel Privacy Policy: https://vercel.com/legal/privacy-policy

c) Cloudflare Inc. (USA):

• Purpose: CDN (Content Delivery Network), DDoS attack protection, website loading acceleration;

• Transferred data: user IP addresses, request technical data;

• Server location: Cloudflare global server network including USA, Europe, Asia and other regions;

• Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

7.3. Data Protection Guarantees During Cross-border Transfer

Controllers take reasonable measures to ensure personal data protection during cross-border transfer:

• use services with reputation of reliable cloud service providers;

• require third-party services to comply with data protection and privacy standards;

• apply technical protection measures (data encryption during transfer and storage, access control);

• inform data subjects about data transfer to third countries.

Controllers draw participants' attention to fact that legislation of countries to which data is transferred (in particular, USA) may not provide same level of personal data protection as legislation of European Union or Republic of Kazakhstan. By providing their personal data, participant is aware of these risks and agrees to cross-border data transfer.

7.4. Right to Withdraw Consent to Cross-border Transfer

Participant has right at any time to withdraw their consent to cross-border personal data transfer. In this case, Controllers cease processing participant's data and delete it in procedure established by Section 8 of this Policy.

Withdrawal of consent to cross-border transfer makes participation in ValQayum project tournaments impossible, as platform functioning technically depends on using specified third-party services.

Section 8. Retention Periods and Complete Deletion Regulations

8.1. General Principles for Determining Retention Periods

Participants' personal data is stored by Controllers no longer than necessary to achieve their processing purposes established by this Policy, or until consent withdrawal by data subject (Art. 5(1)(e) GDPR, Art. 13 RK Law on Personal Data).

8.2. Retention Periods by Data Categories

a) Participant Registration Application Data:

• Retention period: 3 months from tournament completion date for which application was submitted. Data received from Discord at sign-in, including the account identifier, is deleted within the same period.

• Justification: this period is necessary to resolve possible disputes, review participant claims, prepare tournament results reports.

b) Financial Data (Payment Confirmations, Receipts):

• Retention period: 6 months from tournament completion date.

• Justification: this period is necessary to comply with Republic of Kazakhstan tax legislation requirements, resolve financial disputes, refund funds in case of justified claims.

c) Tournament Prize Winners Data (Full Name, Prize Payout Details):

• Retention period: 3 years from prize money payout date.

• Justification: this period corresponds to general limitation period for civil cases in accordance with Art. 178 CC RK and tax legislation requirements.

d) Technical Data (Visit Logs, IP Addresses):

• Retention period: 30 calendar days from visit date.

• Justification: this period is necessary to identify and prevent technical incidents, platform attacks, investigate rule violations.

e) Disqualified Participants and Violators Data:

• Retention period: 3 years from disqualification date.

• Justification: this period is necessary to prevent repeated participation of violators in tournaments, protect Controllers' and other participants' legitimate interests.

8.3. Complete Personal Data Deletion Regulations

After established retention periods expiration or upon data subject request, Controllers carry out complete personal data deletion in following procedure:

Step 1. Data Anonymization or Blocking: Personal data whose retention period has expired is blocked (access to it is restricted) and marked for deletion.

Step 2. Data Deletion from Main Database: Within 14 calendar days from retention period expiration or deletion request receipt, personal data is deleted from main database (Supabase) by executing irrevocable record deletion command (DELETE).

Step 3. Backup Copies Deletion: Within 90 calendar days from data deletion from main database, data is deleted from all backup copies and archival systems. This period is due to technical features of third-party service backup systems (Supabase).

Step 4. Deletion Confirmation: After deletion procedure completion, Controllers send data subject (upon their request) written confirmation of personal data deletion.

8.4. Exceptions from Deletion Rules

Controllers have right not to delete personal data after established periods expiration or upon data subject request in following cases:

• data retention is required in accordance with Republic of Kazakhstan legislation (tax, accounting legislation);

• data is necessary for establishment, exercise or defense of Controllers' legal claims (in case of pending litigation or claim);

• data subject gave consent for further data storage.

In specified cases, data is retained until elimination of grounds for its retention, after which it is deleted in accordance with these regulations.

Section 9. Technical Protection Measures and Data Breach Response Protocol

9.1. Technical and Organizational Protection Measures

Controllers apply modern technical and organizational measures to protect personal data from unauthorized or unlawful access, destruction, modification, blocking, copying, distribution, as well as from other unlawful actions (Art. 32 GDPR, Art. 14 RK Law on Personal Data).

Technical Protection Measures:

• Data Encryption During Transfer: all connections to official ValQayum project website are protected by HTTPS protocol (TLS 1.2+), ensuring data encryption during transfer between user browser and server.

• Data Encryption During Storage: personal data stored in Supabase database is protected by database-level encryption means (encryption at rest).

• Access Control: only authorized Controllers (Ken, AVS) have access to participants' personal data using individual accounts and strong passwords.

• Authentication and Authorization: access to platform administrative functions is protected by multi-factor authentication (MFA) and role management system (RBAC).

• DDoS Attack Protection: website is protected by Cloudflare service providing malicious traffic filtering and DDoS attack prevention.

• Regular Software Updates: Controllers ensure timely updating of used software components and elimination of discovered vulnerabilities.

Organizational Protection Measures:

• Privacy Policy: Controllers undertake to comply with this Policy and not disclose participants' personal data to third parties without lawful grounds.

• Training and Instruction: persons having access to personal data are informed about personal data protection legislation requirements and confidentiality obligations.

• Personnel Action Control: Controllers' actions related to personal data processing are recorded in system logs and subject to periodic audit.

9.2. Personal Data Breach Response Protocol (Data Breach)

In case of personal data protection breach (leak, unauthorized access, accidental data destruction or modification, hereinafter "Incident"), Controllers undertake to act in accordance with following protocol:

Step 1. Incident Detection and Recording (Immediately): Upon detecting Incident signs, Controllers immediately record:

• Incident detection date and time;

• Incident nature (leak, unauthorized access, data destruction, etc.);

• affected personal data categories and approximate quantity;

• circle of data subjects who may be affected by Incident.

Step 2. Incident Localization and Elimination (Within 24 Hours): Controllers take measures to localize Incident and prevent further data leak or damage:

• blocking compromised accounts;

• changing access passwords;

• closing vulnerabilities;

• restoring data from backup copies (if applicable).

Step 3. Risk Assessment for Data Subjects (Within 48 Hours): Controllers assess risks for rights and freedoms of data subjects affected by Incident:

• High risk: if Incident may result in financial damage, reputational harm, discrimination or other serious negative consequences for data subjects;

• Low risk: if Incident does not create significant risks for data subjects (for example, non-confidential data leak).

Step 4. Supervisory Authority Notification (Within 72 Hours, if Applicable): If Incident creates risk for data subjects' rights and freedoms, Controllers notify personal data protection supervisory authority (depending on jurisdiction) within 72 hours from Incident detection (Art. 33 GDPR).

Notification contains:

• Incident nature description;

• affected data subjects categories and approximate number;

• affected personal data records categories and approximate number;

• Incident probable consequences;

• measures taken or planned to eliminate Incident and mitigate its negative consequences.

Step 5. Data Subjects Notification (Without Undue Delay, if Risk is High): If Incident creates high risk for data subjects' rights and freedoms, Controllers notify affected data subjects without undue delay (Art. 34 GDPR).

Notification is sent to participants' contact data (Discord, Telegram, email) and contains:

• Incident nature description in accessible and understandable language;

• Controllers' responsible person contact data for obtaining additional information;

• Incident probable consequences description;

• recommendations to data subjects on protecting their interests (changing passwords, monitoring financial operations, etc.).

Step 6. Incident Documentation and Analysis: Controllers document all facts related to Incident, measures taken and their results. After Incident elimination, analysis of its causes is conducted and measures to prevent similar incidents in future are developed.

9.3. Controllers' Liability in Case of Data Breach

Controllers bear liability for improper performance of personal data protection obligations in accordance with legislation of Republic of Kazakhstan, Russian Federation, and European Union.

While Controllers' liability is limited to cases when Incident occurred due to Controllers' fault (negligence, intentional security requirements violation).

Controllers are not responsible for data breach that occurred:

• due to third party fault (third-party service servers hacking Supabase, Vercel, Cloudflare);

• as result of data subject's own actions (participant disclosure of their credentials, passwords);

• due to force majeure circumstances that Controllers could not foresee or prevent.

Section 10. Data Subject Rights (Access, Rectification, Consent Withdrawal, Erasure)

10.1. Right of Access to Personal Data (Art. 15 GDPR)

Data subject has right to receive from Controllers confirmation whether their personal data is being processed, and receive access to following information:

• processed personal data categories;

• processing purposes;

• recipients or recipient categories to whom personal data has been or will be disclosed;

• planned personal data retention period;

• information about personal data source (if data was not obtained from subject themselves);

• information about automated decision making existence including profiling.

Controllers undertake to provide copy of personal data being processed within 14 calendar days from data subject request receipt.

10.2. Right to Rectification of Personal Data (Art. 16 GDPR)

Data subject has right to require rectification of inaccurate or incomplete personal data concerning them.

To exercise this right, data subject submits request to Controllers indicating:

• data subject to rectification;

• correct information;

• rectification necessity justification (if applicable).

Controllers undertake to review request and make rectifications within 7 calendar days from request receipt if request is justified.

10.3. Right to Erasure of Personal Data ("Right to be Forgotten", Art. 17 GDPR)

Data subject has right to require erasure of their personal data in following cases:

• personal data is no longer necessary for purposes for which it was collected;

• data subject withdraws consent to personal data processing, and there are no other legal grounds for processing;

• personal data was processed unlawfully;

• personal data must be erased to comply with legal obligation.

Controllers undertake to erase data subject's personal data within 14 calendar days from justified request receipt in procedure established by Section 8 of this Policy.

Exceptions from Erasure Right: Controllers may refuse to erase personal data if their processing is necessary:

• to comply with legislation requirements;

• for establishment, exercise or defense of legal claims.

10.4. Right to Restriction of Personal Data Processing (Art. 18 GDPR)

Data subject has right to require restriction of their personal data processing in cases:

• contesting personal data accuracy (restriction for accuracy verification period);

• data processing is unlawful, but data subject objects to erasure and requires use restriction;

• Controllers no longer need personal data for processing purposes, but they are required by subject for establishment, exercise or defense of legal claims.

When processing is restricted, personal data may be stored but not used in other ways without data subject consent.

10.5. Right to Withdraw Consent to Personal Data Processing

Data subject has right at any time to withdraw their consent to personal data processing by submitting corresponding request to Controllers.

Consent withdrawal does not affect lawfulness of personal data processing carried out before consent withdrawal.

After receiving consent withdrawal request, Controllers undertake to cease personal data processing and delete it in procedure established by Section 8, except when data retention is required by legislation.

10.6. Right to Object to Personal Data Processing (Art. 21 GDPR)

Data subject has right at any time to object to processing of their personal data carried out based on Controllers' legitimate interests.

Upon receiving objection, Controllers must cease personal data processing, except when Controllers prove existence of compelling legitimate grounds for processing that override data subject interests, rights and freedoms.

10.7. Right to Data Portability (Art. 20 GDPR)

Data subject has right to receive personal data provided by them to Controllers in structured, commonly used and machine-readable format and transmit this data to another data controller.

Controllers undertake to provide personal data in JSON or CSV format upon data subject request within 14 calendar days from request receipt.

10.8. Right to Lodge Complaint with Supervisory Authority

Data subject has right to lodge complaint with personal data protection supervisory authority if they believe their personal data processing violates applicable personal data protection legislation.

Supervisory Authorities:

• Republic of Kazakhstan: Committee of National Security of Republic of Kazakhstan (Special Communications Service);

• Russian Federation: Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor);

• European Union: supervisory authority of EU member state in whose territory data subject is located.

Section 11. Specifics of Processing Data of Persons Under 18 Years

11.1. Legal Grounds for Processing Minor Data

Processing personal data of persons aged 14 to 18 is carried out in accordance with:

• Law of Republic of Kazakhstan "On Rights of Child in Republic of Kazakhstan" dated August 8, 2002 No. 345-II;

• Art. 9 RK Law on Personal Data (requirement to obtain legal representative consent);

• Art. 8 GDPR (conditions of child consent applicability in relation to information society services).

11.2. Mandatory Parental (Legal Guardian) Consent

To process personal data of minor aged 14 to 18, Controllers must obtain:

• consent of minor themselves to tournament participation and their personal data processing;

• written consent of parent (legal guardian) of minor.

Parent consent must contain:

• confirmation of familiarization with this Privacy Policy;

• consent for collection, processing, storage and use of minor personal data for purposes specified in Section 4 of this Policy;

• consent for cross-border personal data transfer in accordance with Section 7;

• parent (legal guardian) signature and signing date.

11.3. Restrictions on Processing Minor Data

Controllers undertake to:

• not collect excessive personal data of minors (only data necessary for registration and tournament participation is processed);

• not publish minor personal data in open access without parental (legal guardian) consent;

• apply enhanced protection measures for minor data from unauthorized access and breaches;

• immediately delete minor data at parent (legal guardian) request.

11.4. Rights of Parents (Legal Guardians)

Parents (legal guardians) of minor participants have right to:

• request access to their child's personal data;

• require rectification of inaccurate data;

• require erasure of child's data;

• withdraw consent for processing child's data at any time;

• lodge complaints with personal data protection supervisory authorities.

To exercise specified rights, parent (legal guardian) submits corresponding request to Controllers with attachment of document confirming family relationship or legal guardian status.

Section 12. Procedure for Submitting and Reviewing User Appeals

12.1. Methods for Submitting Appeals

Data subjects may submit appeals, requests, complaints and claims related to personal data processing to Controllers by following methods:

• email: to Controllers' official address (published on ValQayum project website);

• Discord: through official ValQayum project server;

• Telegram: through official ValQayum project channel;

• feedback form on official website (if available).

12.2. Appeal Content

Appeal must contain:

• appellant's data (full name or nickname, Discord ID / Telegram ID, Riot ID);

• appeal essence (request for data access, rectification, erasure, complaint, etc.);

• appeal justification (if applicable);

• contact data for sending response.

When submitting appeal on behalf of minor, parent (legal guardian) must attach copy of document confirming their status.

12.3. Appeal Review Periods

Controllers undertake to review data subject appeal and send reasoned response within following periods:

• request for access to personal data: 14 calendar days;

• request for rectification of personal data: 7 calendar days;

• request for erasure of personal data: 14 calendar days;

• complaint about data subject rights violation: 14 calendar days;

• other appeals: 14 calendar days.

If appeal review period extension is necessary (in case of request complexity, need for information verification, etc.), Controllers notify data subject about period extension and indicate extension reasons. Maximum appeal review period cannot exceed 30 calendar days from appeal receipt.

12.4. Response to Appeal

Response to appeal is sent to data subject by same method appeal was received, or by other method agreed with data subject.

Response contains:

• confirmation of appeal receipt and review;

• information requested by data subject (if applicable);

• Controllers' decision on appeal (request satisfaction, refusal with justification);

• information about data subject's right to appeal decision to supervisory authority or court.

12.5. Refusal to Satisfy Appeal

Controllers may refuse to satisfy data subject appeal in following cases:

• appeal does not contain necessary information for data subject identification;

• request is clearly unfounded or excessive (repeated identical requests without circumstance changes);

• request satisfaction contradicts legislation requirements (for example, erasure of data whose retention is mandatory by law);

• data subject did not provide documents confirming their authority (for appeals on behalf of minors or third parties).

Refusal to satisfy appeal must be reasoned and contain explanation of data subject's right to appeal refusal.

Section 13. Privacy Policy Amendment and Final Provisions

13.1. Controllers' Right to Amend Policy

Controllers reserve right to unilaterally amend and supplement this Privacy Policy at any time.

Amendments enter into force from moment of publishing new Policy version on official ValQayum project website, unless otherwise specified in amendment text.

Material Policy changes (changing processing purposes, expanding recipient circle, changing retention periods, etc.) are brought to users' attention by publishing notification on website and in official communication channels at least 7 calendar days before amendments enter into force.

13.2. User Obligation to Monitor Changes

User is obliged to independently monitor changes to this Privacy Policy by regularly checking current version on official ValQayum project website.

Continued website use, tournament participation or other interaction with Controllers after publishing Policy amendments means user agreement with new Policy version.

If user disagrees with introduced amendments, they have right to refuse using ValQayum project services and request erasure of their personal data in accordance with Section 10.

13.3. Contact Information for Personal Data Protection Inquiries

All questions related to personal data processing and protection within ValQayum project may be submitted to Controllers:

• Official Email Address: (published on ValQayum project website)

• ValQayum Project Discord Server

• ValQayum Project Telegram Channel

Controllers undertake to review all user appeals within periods established by this Policy and provide complete information about personal data processing procedure.

13.4. Applicable Law and Jurisdiction

This Privacy Policy and all relations related to personal data processing within ValQayum project are governed by legislation of Republic of Kazakhstan.

Disputes related to this Policy application are resolved in procedure established by Section 15 of ValQayum project Tournament Terms of Participation (mandatory pre-trial claim procedure, jurisdiction at Controllers' location or consumer's place of residence).

13.5. Final Provisions

By using official ValQayum project website, registering to participate in tournaments, or otherwise providing their personal data to Controllers, user confirms that:

• familiarized with this Privacy Policy in full;

• understands purposes, methods and conditions of their personal data processing;

• gives voluntary, informed and conscious consent to their personal data processing in accordance with this Policy;

• is aware of risks related to cross-border personal data transfer and agrees to such transfer;

• has no objections to automated data processing means application (team balancing algorithm).

ValQayum Project Organizers:
Ken, AVS

Publication Date: August 28, 2026
Document Version: 1.0

*This Privacy Policy is compiled in accordance with Law of Republic of Kazakhstan "On Personal Data and Their Protection" dated May 21, 2013 No. 94-V, Federal Law of Russian Federation "On Personal Data" dated July 27, 2006 No. 152-FZ, and General Data Protection Regulation of European Union (GDPR, Regulation (EU) 2016/679).*

*Personal data processing is carried out in compliance with principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity and confidentiality.*