Privacy Policy

This Privacy Policy (the «Policy») describes what personal data is collected by the PartnerPortal service (the «Service») hosted at www.partnerportal.kz, and how we process, store and protect it.

The Policy is developed in accordance with the Law of the Republic of Kazakhstan «On personal data and its protection» dated May 21, 2013, No. 94-V (as amended as of March 2, 2026).

By using the Service, the User consents to the processing of their personal data in the manner and on the terms set out in this Policy.

Depending on the User's role, the Service collects the following data:

We use the collected data solely for the following purposes:

• providing access to the Service and its functionality;
• recording clicks, conversions and accruing rewards to Partners;
• processing Partner payouts using the provided details;
• sending service notifications (application and payout status changes, new conversions);
• technical support of Users;
• protecting the Service from fraud and abuse;
• complying with the laws of the Republic of Kazakhstan.

The Service uses cookies and similar technologies for affiliate tracking to work correctly. In particular:

• pp_ref — the Partner's referral code identifying who brought the visitor;
• pp_cookie_id — a unique click identifier used to tie the visit to a conversion;
• Supabase Auth session cookies — to keep the User logged in.

Tracking-cookie lifetime is configured by the Program owner (30 days by default, up to 90 days). The User can delete cookies at any time via browser settings.

We do not sell or share personal data with third parties except in the following cases:

• sharing data with infrastructure providers (Supabase, Vercel) solely to host and operate the Service;
• sharing data with the Program owner — only the portion needed to compute Partner rewards;
• disclosing data at the request of government authorities in the manner established by the laws of the Republic of Kazakhstan.

Personal data is stored on the servers of the Supabase cloud platform (PostgreSQL) with encryption at rest (AES-256) and in transit (TLS 1.2+). Access is limited to authorized Operator personnel trained to handle personal data.

Backups are performed automatically. User passwords are stored as cryptographic hashes (bcrypt) and are not accessible to Operator personnel in plain text.

Data is retained for the duration of the account and for 30 calendar days after deletion. Financial-transaction data may be retained longer in accordance with tax and accounting requirements.

Under applicable law, the User has the right to:

• obtain information about the personal data the Service processes about them;
• request correction, blocking, or erasure of their data;
• withdraw consent to the processing of personal data;
• delete the account via «Settings» — this triggers irreversible removal of all related data;
• file a complaint with the competent personal-data protection authority.

The Service is not intended for use by persons under 18. We do not knowingly collect personal data of minors. If you become aware of such a case, please contact us.

The Operator may update this Policy. The current version is always available at www.partnerportal.kz/privacy. For material changes, Users are notified by email at least 14 calendar days before the changes take effect.

For personal-data inquiries, contact us at: info@partnerportal.kz.