Privacy and Personal Data Processing Policy

1. General Provisions

1.1. This Privacy Policy (hereinafter — the "Policy") defines the procedure for the processing and protection of personal data of users of the official website unionkg.org (hereinafter — the "Website") and the personal account.

1.2. The personal data operator is the Public Association "Association of Professional Footballers of the Kyrgyz Republic" (hereinafter — "APFKR", the "Operator").

1.3. By registering on the Website and/or using its functionality, the user confirms that they have read this Policy and consents to the processing of their personal data on the terms set out below.

1.4. This Policy applies to the processing of personal data obtained through the Website and does not extend to third-party resources to which links may be placed on the Website.

2. What Data We Collect

2.1. When registering and using the Website, APFKR may process the following data:

• full name (surname, given name, patronymic);

• date of birth;

• citizenship;

• actual place of residence;

• phone number;

• email address;

• name of the football club (as stated by the user);

• membership category;

• information about payment of membership fees (date, amount, payment status);

• technical data: IP address, information about the browser and device, date and time of actions on the Website (log data).

2.2. APFKR does not collect passport details, INN/PIN, registration address, or other excessive information unless required for a specific service and separately agreed upon and announced on the Website.

2.3. Within the scope of specific programs and events (for example, the Free Agents Camp / training camp), APFKR may collect photo and video materials featuring the user. Such materials are collected and used solely with the user's separate consent provided at the moment of submitting the corresponding application. Consent to the use of media materials is separate from the general consent to personal data processing and may be withdrawn by the user at any time by contacting APFKR.

3. Purposes of Data Processing

Personal data are processed for the following purposes:

• registration of the user and creation of an account;

• verification of identity and registration data by an administrator (moderation);

• granting access to the personal account and to the trade union's services;

• accounting of membership and the status of membership-fee payments;

• sending notifications (about registration, account confirmation, successful payment, and other events related to membership);

• ensuring the security of the Website and preventing abuse;

• preparation of APFKR's internal reporting to the minimum necessary extent;

• use of the member's name, image and visual likeness within the scope of APFKR's statutory activities, including the publication of informational and presentation materials;

• use of the name and image in digital products, as well as the transfer of the corresponding rights to FIFPro for the purposes of representing and protecting the interests of professional footballers;

• compliance with the requirements of the legislation of the Kyrgyz Republic.

4. Legal Grounds for Processing

4.1. Personal data are processed on the following grounds:

• the consent of the user given at registration on the Website;

• the need to perform the User Agreement and the Public Offer for payment of the membership fee;

• requirements of the legislation of the Kyrgyz Republic, including in the field of accounting and taxation.

5. Consent to the Processing of Personal Data

5.1. Consent to the processing of personal data is given by the user at the time of registration on the Website by ticking the corresponding box in the registration form. The tick confirms that the user has read this Policy and agrees to the processing of their data for the purposes listed in Section 3.

5.2. The user may withdraw consent to the processing of personal data at any time by sending a request to apfkr@outlook.com. After withdrawal of consent, APFKR shall cease processing the data, except where processing is necessary to comply with legal requirements or to protect the rights of the parties.

5.3. Withdrawal of consent may make it impossible to use the personal account and may result in termination of membership in APFKR.

5.4. If automatic debiting of the membership fee (auto-debit) is enabled in the future, consent to recurring debits will be obtained separately in the user's personal account. By default, auto-debit is disabled and is not enabled automatically.

6. Retention Periods

6.1. User account data are stored for the period the account is active and for one (1) year after its deletion — for the purposes of record-keeping and resolution of possible disputes.

6.2. Information about payments of membership fees is stored for five (5) years from the date of the payment — in accordance with the accounting legislation of the Kyrgyz Republic.

6.3. Consent logs (date, time, version of the documents the user has read) are stored for three (3) years — to confirm the lawfulness of processing and to protect the interests of the parties.

6.4. Technical data (IP addresses, log files of actions on the Website) are stored for no more than twelve (12) months, unless retention for a longer period is required to investigate security incidents.

6.5. Upon expiry of the established retention periods, personal data are deleted or anonymized.

7. Transfer of Data to Third Parties

7.1. APFKR may transfer personal data to third parties only to the extent necessary for the operation of the Website and the processing of payments, including:

• the hosting provider and the cloud-services provider (for hosting the Website);

• email notification services;

• the bank and the payment provider (for processing payments);

• web-analytics services (in anonymized form — see Section 8);

• state authorities — in the cases and in the manner provided for by the legislation of the Kyrgyz Republic.

7.2. APFKR does not sell personal data and does not transfer them for advertising purposes.

7.3. Users' bank-card details are not stored on the Website's side. Payments are processed by the bank or by the payment provider. If auto-debit is enabled in the future, a token (an identifier of the payment instrument) may be used at the provider's side without transmitting the full card details to APFKR.

7.4. APFKR is entitled to transfer members' personal data to FIFPro and other persons engaged for the purposes of representing and protecting the interests of professional footballers, including cross-border transfer, in the volume necessary to achieve the said purposes and on the basis of the consent provided when submitting the membership application.

8. Cookies and Analytics

8.1. The Website uses cookies — small text files that are stored in the user's browser and allow the Website to operate correctly.

8.2. The following categories of cookies are used on the Website:

Necessary (technical) cookies

Provide the basic operation of the Website: authentication, session storage, security. Without them, the Website cannot function.

Analytical cookies

Used to collect anonymized statistics on website traffic and user behavior in order to improve the Website's operation. They do not allow a specific user to be identified.

8.3. On the user's first visit to the Website, an informational notice on the use of cookies is shown together with a link to this Policy. Continued use of the Website constitutes consent to the use of cookies.

8.4. The user may at any time restrict or prohibit the use of cookies in their browser settings, as well as delete previously stored cookies. In that case, some features of the Website may not work correctly.

8.5. The retention period of cookies depends on their type: session cookies are deleted when the browser is closed; persistent cookies are stored for an established period (as a rule, no more than 12 months).

9. Data Protection

9.1. APFKR takes reasonable organizational and technical measures to protect personal data from unauthorized access, alteration, disclosure, or destruction, including:

• differentiation of access rights to data;

• password protection and restriction of access to the administrative panel;

• data backups;

• logging of administrators' actions;

• use of a secure connection (HTTPS).

10. User Rights

The user has the right to:

• request information about the processing of their personal data;

• demand the clarification, updating, or deletion of their data;

• withdraw consent to the processing of personal data (subject to clause 5.3);

• appeal APFKR's actions to the competent state authority of the Kyrgyz Republic in the field of personal data protection;

• contact the Operator on any matter concerning data processing using the contact details indicated in Section 13.

11. Minors

11.1. The Website is intended for adult users. APFKR does not deliberately collect the personal data of persons under the age of 18.

11.2. If APFKR becomes aware that data of a minor have been registered in the system without appropriate consent, such data will be deleted.

12. Changes to the Policy

12.1. APFKR has the right to make changes to this Policy. The new version enters into force from the moment of its publication on the Website.

12.2. The date of the latest revision is indicated at the beginning of the document. It is recommended to periodically check the Policy for updates.

12.3. Users are notified of material changes by email and/or via a notification in the personal account.

13. Contacts

For matters concerning the processing of personal data and the exercise of user rights:

Operator: Public Association "Association of Professional Footballers of the Kyrgyz Republic" (APFKR)

Address: Bishkek, Kyrgyz Republic, 12-4-28

Email: apfkr@outlook.com, djanybaev@gmail.com

Phone: +996 709 479 000, +996 770 527 171

Website: unionkg.org