P I G M E N T W O R L D

Anna Savina Dermopigmentation Academy · pigment-world.com

PUBLISHED ON THE WEBSITE · DOCUMENT NO. 02

PERSONAL DATA PROCESSING POLICY

Version dated October 26, 2026

1. Who processes your data
The controller of personal data records is Individual Entrepreneur Petchenko Mariya Alekseevna, registered in the Kyrgyz Republic.
Tax Identification Number (INN)
11011198140019
Registration number
001-2026-169-1766
Address
151A/2 Imanalieva St., Orto-Sai, Oktyabrsky District, Bishkek, Kyrgyz Republic
Email for personal data inquiries
pigment.world.pmu@gmail.com
Phone
+996 555 935 935
Personal data is processed in accordance with Chapter 11 (Articles 77–91) of the Digital Code of the Kyrgyz Republic dated July 31, 2025, No. 178.
The supervisory authority is the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic (dpa.gov.kg).
2. What data we collect2.1. Data you provide directly
Identification data
Last name, first name, and patronymic.
Contact data
Email address, phone number, and messenger account.
Location data
Country and city of residence.
Training data
Selected Plan, assignment and assessment results, and correspondence with instructors or mentors.
Payment data
Payment information, including amount, date, status, and transaction ID.
We do not receive or store your bank card number, expiration date, or security code. This information is entered directly on the payment provider’s platform and is not transmitted to us.
2.2. Data collected automatically
We may collect your network address, device and browser type, operating system, country in which your payment card was issued, international telephone dialing code, referral source, information about your actions on the Website, and cookie identifiers.
We are required to collect some of this information in order to determine your country of location where required by the tax laws of jurisdictions in which our services are subject to taxation.
2.3. Information about contraindications — specially protected data
If you participate in the practical portion of the training, either as a student or as a Model, we process information you provide regarding contraindications to the procedure to the extent included in the informed consent form.
Such information is classified as specially protected data under Article 80 of the Digital Code. We process it on the basis of your separate written consent and for the protection of vital interests, store it separately from other data, restrict access to the instructor and the responsible person, and delete it once the training has been completed.
We do not process biometric data, information about political opinions or religious beliefs, and we do not request medical information beyond what is necessary to determine whether you may safely participate in the procedure.
3. Why we process your data and the legal basis for processing
The Digital Code permits personal data processing where at least one lawful basis applies. Consent is required only where no other lawful basis is available.
Entering into and performing the Agreement: processing orders, providing access to materials, organizing classes, and issuing a training completion document
Legal basis: performance of the Agreement.
Accounting and tax records, issuing receipts, and retaining primary accounting documents
Legal basis: compliance with a legal obligation.
Handling inquiries and complaints and protecting our rights in the event of a dispute
Legal basis: legitimate interest.
Service-related notifications concerning changes in the provision of services
Legal basis: performance of the Agreement.
Ensuring the safety of practical procedures: processing information about contraindications
Legal basis: separate consent and protection of vital interests.
Participation in the alumni club
Legal basis: consent expressed by joining the club.
Recruitment and entering into and performing agreements with contractors
Legal basis: performance of an agreement; consent is used for retaining an application after a candidate has been rejected.
Marketing emails, invitations to webinars, and event invitations
Legal basis: consent.
Website behavior analytics and targeted advertising
Legal basis: consent.
Publishing testimonials, photographs of work, and a person’s image together with their name
Legal basis: separate consent.
Consent may be withdrawn at any time. The process for withdrawing consent will not be more burdensome than the process used to provide it. If consent was provided by checking a box on the Website, it may be withdrawn through a link in an email or by contacting us at the email address specified in this Policy.
Withdrawal of consent to marketing communications does not affect performance of an existing Agreement. Access to paid materials will remain available.
4. Who we share data with
We share data only with recipients whose services are necessary for us to provide our services.
Hosting provider
Data shared: technical data and Website content.
Purpose: Website hosting.
Payment provider
Data shared: payment amount, order ID, and contact information.
Purpose: payment processing.
Distance-learning platform
Data shared: name, contact information, and learning progress.
Purpose: providing access to educational materials.
Private community platform
Data shared: name and contact information.
Purpose: participation in the alumni club.
Email service provider
Data shared: name and email address.
Purpose: sending emails.
Analytics services
Data shared: anonymized and technical data.
Purpose: traffic and usage analysis.
Fiscal data operator and tax authorities
Data shared: transaction information.
Purpose: compliance with legal requirements.
Photographs of student work and areas where procedures are performed are not shared with third parties and are used only where separate consent has been obtained.
We enter into agreements with each recipient acting on our behalf requiring them to process personal data only for our purposes and to ensure appropriate protection of that data.
We do not sell personal data and do not disclose it to third parties for their own marketing purposes.
5. Transfers of data outside the Kyrgyz Republic
Some of the services listed above are located outside the Kyrgyz Republic. This constitutes a cross-border transfer of personal data within the meaning of Article 89 of the Digital Code.
As of the date of this version of the Policy, the authorized authority has not published a list of countries recognized as providing an adequate level of personal data protection. Therefore, cross-border transfers are carried out on the following legal bases.
Data necessary to perform the Agreement, including Website hosting, payment processing, and access to the learning platform
Legal basis: performance of the Agreement under Article 89 of the Digital Code of the Kyrgyz Republic and contractual safeguards included in agreements with recipients.
Data used for marketing communications, analytics, and targeted advertising
Legal basis: your separate consent and contractual safeguards included in agreements with recipients.
This distinction is important: transfers that are necessary to provide a paid service do not depend on consent and therefore do not stop when consent is withdrawn. Withdrawal of consent stops only transfers made for marketing and analytics purposes.
We do not store the personal data of citizens of the Kyrgyz Republic exclusively within the territory of the Kyrgyz Republic because Kyrgyz law does not impose a personal data localization requirement.
6. How long we retain your data
Account information and learning progress
For the term of the Agreement and 3 years after it ends.
Accounting and tax records
For the period required by law, but not less than 5 years.
Transaction data, including information about the country of location
5 years.
Marketing mailing data
Until consent is withdrawn.
Alumni club member data
For the duration of membership and 1 year after membership ends.
Inquiries and complaints
3 years from the date they are resolved.
Information about contraindications
Until completion of the training, after which it is deleted.
Signed Model consent forms
3 years.
Job applicant submissions
6 months.
Access logs
1 year.
Once the applicable retention period expires, the data is deleted or anonymized. Data that must be retained for a period established by law will be retained for that period regardless of withdrawal of consent.
We collect only the data necessary for the stated purposes and do not retain it longer than necessary to achieve those purposes.
7. Your rights
You have the right to:

• obtain information about whether we process your personal data and what processing takes place;
• access your personal data;
• request correction of inaccurate personal data;
• request deletion of your personal data;
• withdraw consent;
• object to processing.

Response period. We provide a reasoned written response to an objection to processing within seven business days, in accordance with Article 84 of the Digital Code. We apply the same response period to other data subject requests.
Requests should be sent to pigment.world.pmu@gmail.com. To verify your identity, we may request additional information necessary to confirm that the request was submitted by the data subject.
We may decline to comply with a request to the extent that applicable law requires us to retain the relevant data. In such a case, we will explain the legal basis and specify which data must continue to be retained.
If you believe your rights have been violated, you may contact the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic.
8. How we protect your data
We use technical and organizational measures proportionate to the relevant risks, including:

• transmission of data using secure protocols;
• role-based access controls, with access granted only to persons who need it;
• password policies and two-factor authentication for administrative access;
• access logging;
• backups with restoration testing;
• confidentiality obligations in agreements with contractors;
• records of processing activities in accordance with Article 88 of the Digital Code.

No system can provide absolute security. If we identify an incident that creates a risk to your rights, we take measures to mitigate its consequences and notify you where notification is necessary to protect your interests.
9. Cookies9.1. What cookies are
Cookies are small text files that a website stores on your device. They allow the Website to remember your actions and settings and collect information about how the Website is used.
Similar technologies may also be used, including pixels, browser local storage, and device identifiers.
Cookies that can identify a user are treated as personal data because the definition of personal data includes online identifiers. Their use is therefore governed by this Policy in the same way as other personal data.
9.2. Categories of cookies
Strictly necessary cookies. These cookies enable essential Website functions, including authentication, saving items in the shopping cart, session security, and remembering your cookie preferences.
Legal basis: performance of the Agreement and legitimate interest.
These cookies cannot be disabled through our cookie settings because the Website cannot function properly without them, and consent is not required for their use.
Retention period: for the duration of the session or up to 12 months.
Analytics cookies. These cookies help us understand which pages are viewed, how much time users spend reviewing materials, and at what stage users leave the checkout process.
They are used in aggregated form.
Legal basis: your consent.
Disabled by default.
Retention period: up to 12 months.
Marketing cookies. These cookies are used to display advertising, measure advertising effectiveness, and limit how often ads are shown.
They may be placed by advertising platforms and may involve the transfer of data outside the Kyrgyz Republic.
Legal basis: your consent.
Disabled by default.
Retention period: up to 12 months.
Functional cookies. These cookies remember interface language, region, and previously viewed pages.
Legal basis: your consent.
Disabled by default.
Retention period: up to 12 months.
9.3. How you manage your choices
When you first visit the Website, a notice is displayed allowing you to select cookie categories.
Non-essential categories are disabled by default and are activated only through your explicit action. No boxes are pre-checked. Silence or inactivity does not constitute consent.
You may change your choices at any time through the cookie settings section, a link to which is available at the bottom of every Website page. Withdrawing consent is no more difficult than providing it.
You may also manage cookies using your browser settings, including deleting stored cookies, blocking cookies, or using private browsing mode.
Blocking strictly necessary cookies through your browser may prevent certain Website features from functioning properly, including checkout and access to your Personal Account.
10. Data relating to minors
Our services are intended for persons aged 18 or older.
We do not knowingly collect personal data relating to minors.
If you believe that we have received such data, please contact us at pigment.world.pmu@gmail.com and the data will be deleted.
11. Changes to this Policy
We may amend this Policy.
The current version is published on the Website together with the effective date.
If material changes affect the purposes of processing or categories of recipients, we will notify you by email.
Changes do not apply to relationships that arose before publication to the extent that doing so would worsen the position of the data subject.
Previous versions are retained and are available upon request.