Privacy Policy (GDPR, Tilda, DPA & SCC Compliance)
This Privacy Policy explains how personal data is collected, used, and protected when you use the website baskova.guide (the “Website”), in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable laws of the Republic of Kazakhstan.

1. Data Controller
The Data Controller is the owner of the Website baskova.guide (the “Controller”).
The Controller determines the purposes and means of processing personal data.
For any data protection inquiries, please contact us via the contact details provided on the Website.

2. Data We Collect
We may collect and process the following categories of personal data:

• Identification data (name, surname)
• Contact data (email address, phone number)
• Communication data (messages submitted via forms)
• Technical data (IP address, browser type, device information)
• Usage data (interaction with the Website, analytics)

3. Legal Basis for Processing (Art. 6 GDPR)
We process personal data on the following legal bases:

• Consent (Art. 6(1)(a)) — when you submit forms or accept cookies
• Contract (Art. 6(1)(b)) — to provide guiding and tour services
• Legal obligation (Art. 6(1)(c)) — compliance with applicable laws
• Legitimate interests (Art. 6(1)(f)) — improving the Website and services

4. Use of Tilda Platform
This Website is built and hosted using Tilda Publishing.
Tilda may process technical and personal data as a data processor on behalf of the Controller, including:

• hosting and infrastructure
• form data processing
• website analytics (basic level)

Tilda processes data in accordance with its own privacy policy and applicable GDPR requirements.

5. Data Processing Agreement (DPA)
We enter into Data Processing Agreements (DPA) with third-party service providers (processors), including:

• Tilda Publishing (hosting and website builder)
• analytics providers (e.g., Google Analytics)
• communication tools (email, messengers, CRM)

All processors are contractually obligated to:

• process data only on documented instructions
• ensure confidentiality
• implement appropriate security measures (Art. 28 GDPR)

6. International Data Transfers (SCC)
If personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through:

• Standard Contractual Clauses (SCC) approved by the European Commission
• cooperation with providers offering adequate safeguards
• additional technical measures (e.g., encryption, data minimization)

7. Data Retention
We retain personal data only as long as necessary:

• to fulfill the purposes described above
• until consent is withdrawn
• as required by applicable law

After that, data is deleted or anonymized.

8. Your Rights (GDPR)
Under GDPR, you have the right to:

• access your personal data
• correct inaccurate data
• request deletion (“right to be forgotten”)
• restrict processing
• data portability
• object to processing
• withdraw consent at any time
• lodge a complaint with an EU supervisory authority

Requests are processed within 30 days.

9. Cookies and Consent (Tilda Forms & Tracking)
The Website uses cookies and similar technologies, including those integrated via Tilda.
We use:

• essential cookies (required for site functionality)
• analytics cookies (e.g., Google Analytics, if enabled)

A cookie banner is used to obtain user consent before non-essential cookies are activated.
Users can manage or withdraw consent at any time.

10. Data Security (Art. 32 GDPR)
We implement appropriate technical and organizational measures, including:

• restricted access to data
• secure hosting via Tilda infrastructure
• protection against unauthorized access
• regular monitoring and risk assessment

11. Data Breach Notification
In the event of a personal data breach, we will:

• notify the relevant supervisory authority within 72 hours (if required)
• inform affected users if there is a high risk to their rights and freedoms

12. Third-Party Services
The Website may integrate third-party services, including:

• Google Analytics
• messaging apps (e.g., WhatsApp, Telegram)
• embedded content

These services may collect data independently according to their own privacy policies.

13. Changes to This Policy
We reserve the right to update this Privacy Policy.
The latest version will always be available on this page.

14. Contact Information
If you have any questions regarding this Privacy Policy or wish to exercise your rights, please contact us using the contact details provided on the Website.

Last updated: 14/04/2026