SBridge Research Panel — Privacy Policy

This Privacy Policy applies to the SBridge Research Panel — a service operated by SBridge KZ (ТОО «SBridge»), registered in the Republic of Kazakhstan.

The Research Panel connects academic researchers, organizations, and companies ("Researchers") with verified volunteer respondents ("Participants") for surveys, interviews, UX testing, and AI data collection tasks.

This policy explains what personal data we collect, why we collect it, how we use and protect it, and what your rights are under Kazakhstani law and internationally recognised data protection standards.

By registering as a Participant or submitting a research request as a Researcher, you confirm you have read and accepted this policy.

For Participants — we collect:

Identity data: first name, last name, email address, phone number, date of birth
Demographic data: gender, country and city of residence, country of birth, education level, employment status, job sector and role, income range (optional)
Language data: first language, fluency levels in Kazakh, Russian, English, and other languages
Research preferences: types of studies you want to join, availability, preferred payment methods
Payment data: Kaspi phone number, bank card details, or other payout method you provide
Usage data: IP address, device type, login timestamps, study completion records
Quality and compliance data: completion times, fraud flag records, quality scores

Legal basis: Article 8 of the Law of the Republic of Kazakhstan "On Personal Data and its Protection" No. 94-V (2013) — processing based on freely given informed consent.

For Researchers — we collect:

Identity and organisation data: name, email, phone, organisation name, job title
Research project data: study description, targeting criteria, budget, external survey links
Billing data: billing details for invoicing (stored securely, not shared with Participants)

Legal basis: Contractual necessity and legitimate interests.

We do NOT collect:
National identification numbers (IIN) unless legally required
Biometric data
Health or medical records
Political opinions or religious beliefs

We use your personal data only for the following purposes:

Participant matching: Your demographic and language profile is used to determine your eligibility for specific research studies. Researchers see only anonymised aggregate descriptions — they do NOT see your name, email, or phone number unless you explicitly consent to a direct contact study.

Study management: We record your participation, completion status, and approval/rejection of submissions to manage payments and quality.

Payments: Your payment details are used solely to transfer your earned rewards via Kaspi, bank transfer, or other agreed method.

Platform security and fraud prevention: We analyse completion times, IP addresses, and device fingerprints to detect duplicate registrations, bot activity, and fraudulent submissions.

Communications: We send you email notifications about new matching studies, submission status updates, and payment confirmations. You can opt out of marketing emails at any time.

Legal compliance: We may process your data to comply with Kazakhstani law or respond to lawful requests from authorities.

We do NOT:
Sell your personal data to any third party
Share your identifiable data with Researchers without your explicit consent
Use your data for advertising or profiling outside the Research Panel

Researchers receive only anonymised, aggregated demographic information when browsing the participant pool. Your individual identity (name, email, phone) is never revealed to a Researcher unless the study type explicitly requires direct contact (e.g. a live interview) and you individually consent to that specific study.

Service providers who help us operate the platform may process your data on our behalf — for example, our database hosting provider (Vercel/Supabase/Neon), email delivery service, and payment processing partners. All such providers are contractually bound to process data only on our instructions and with adequate security measures.

Law enforcement and regulators: We may disclose data if required by a valid court order, subpoena, or request from Kazakhstani authorities under applicable law.

No transfers outside Kazakhstan occur without ensuring the recipient country provides equivalent data protection, or that you have given explicit consent.

We apply the following security measures to protect your data:

**Encryption in transit:** All data is transmitted over HTTPS/TLS 1.2+
**Encryption at rest:** Sensitive fields (passwords, payment details) are encrypted or hashed in the database
**Access controls:** Only authorised SBridge staff with a legitimate need can access personal data; all access is logged
**No plain-text passwords:** Passwords are stored using bcrypt hashing — we cannot see your password
**Fraud monitoring:** Automated checks detect unusual activity patterns and flag them for manual review
**Regular audits:** We conduct periodic reviews of who has access to data and what is stored

Despite these measures, no system is 100% secure. In the event of a data breach that is likely to affect your rights, we will notify you within 72 hours of becoming aware of it, in accordance with best practice.

Under Kazakhstani data protection law (Law No. 94-V, 2013) and in alignment with GDPR principles, you have the following rights:

Right to access: You can request a copy of all personal data we hold about you.

Right to rectification: You can update or correct inaccurate data through your account settings or by contacting us.

Right to erasure ("right to be forgotten"): You can request deletion of your account and personal data. We will comply unless we are legally required to retain certain records (e.g. transaction records for tax purposes, which we retain for 5 years under Kazakhstani accounting law).

Right to restrict processing: You can ask us to stop using your data for matching purposes while keeping your account open.

Right to data portability: You can request an export of your profile data in a machine-readable format (JSON/CSV).

Right to withdraw consent: You can withdraw your consent to data processing at any time. This will not affect the lawfulness of processing before withdrawal. Withdrawing consent means you will no longer receive study invitations.

Right to object to fraud-related processing: If you believe a fraud flag on your account is incorrect, you have the right to dispute it and request a manual review.

To exercise any of these rights, contact us at +77787098685. We will respond within 30 days.

We retain your data for the following periods:

**Active participant profiles:** For as long as your account is active, plus 2 years after your last activity
**Closed/deleted accounts:** Personal identifiers are deleted within 30 days of account closure. Anonymised statistical data (e.g. aggregate completion counts) may be retained indefinitely
**Payment transaction records:** 5 years from the transaction date (required by Kazakhstani accounting law)
**Fraud flags and security logs:** 3 years from the date of the event
**Study submissions:** 3 years from submission, then anonymised

Researchers' study data (including targeting criteria and study descriptions) is retained for 3 years after study completion.

The SBridge Research Panel is strictly for users aged 18 and above. We do not knowingly collect personal data from anyone under 18.

If you are a parent or guardian and believe your child has registered on the platform, please contact us immediately at +77787098685 and we will delete the account and all associated data without delay.