Privacy Policy

1. Who controls your data

Kale Ltd. (“Kale”, “ORNA Atlas”, “we”, “us”) operates ORNA Atlas and is the controller of personal data described in this policy.

Legal entity

Kale Ltd.

Business Identification Number (BIN)

221040900084

Registered address

010000, Kazakhstan, Astana, Nura district, 50/3 Turan, office 5

Chief Executive Officer

Rim Safiullin

2. Scope

This policy applies when you visit ORNA Atlas, create or use an account, sign in through an identity provider, explore the atlas, listen to recordings, or contact us. Third-party services have their own privacy terms.

3. Data we collect

Data you provide

• Your e-mail address and account credentials. Passwords are stored only as secure hashes, not in readable form.
• Information you send when making a privacy, legal, or support request.

Account and service data

• Account identifiers, roles, membership entitlements, sign-in and refresh-session records.
• Purchase reference, product, amount, currency, payment status, refund-request status, and the verified e-mail used for the fiscal receipt. ORNA does not receive or store your card or Google Pay credentials.
• If you choose social sign-in, the provider, provider account identifier, verified e-mail address, and authentication results needed to sign you in.
• Playback grants and security/audit events needed to protect restricted recordings and accounts.

Technical and usage data

• IP address, user agent, request time, bounded route information, error and security logs.
• Limited conversion events such as starting a sample, listening milestones, and selecting an atlas or membership link. These events use predefined names and placements rather than free-form personal content.
• Essential cookies or similar storage used for secure sign-in, refresh sessions, and service operation.

Location

If you activate “Use current location”, your browser asks for permission and uses the coordinates to select the nearest public listening site. This calculation happens in your browser; ORNA Atlas does not add your device location to your account. Recording locations shown publicly may be generalized or withheld to protect sensitive habitats.

4. How and why we use data

• To provide accounts, authentication, atlas discovery, membership access, and protected playback.
• To create itemized Bereke Bank hosted checkout sessions, support merchant-configured online fiscalization, confirm payments and full refunds, show purchase records, and prevent duplicate processing.
• To secure the service, prevent abuse, investigate incidents, and keep necessary audit records.
• To understand whether core listening and registration journeys work and to improve ORNA Atlas.
• To respond to requests and comply with applicable legal obligations.

Depending on the context and applicable law, we process data to perform our agreement with you, pursue legitimate interests in operating and securing the service, comply with law, or act on your consent where consent is required. You can withdraw consent without affecting earlier lawful processing.

5. When data is shared

We do not sell personal data. Personal data may be processed or received by:

• infrastructure, hosting, storage, monitoring, and other processors that operate the service for us;
• Google, Apple, or Facebook when you choose that provider for sign-in;
• Bereke Bank, its payment-system participants, and the merchant-configured fiscal/OFD receipt channel when you open checkout, make a payment, receive a fiscal receipt, or request a refund;
• professional advisers, authorities, or other parties when required by law or needed to establish, exercise, or defend legal claims; or
• a successor in a merger, reorganization, or transfer, subject to appropriate safeguards.

Map imagery provider

When you open the interactive atlas, your browser may request ArcGIS World Imagery tiles directly from Esri. As the recipient of that request, Esri ordinarily receives your IP address, user agent, and request metadata and processes that information under its own privacy terms. Kale does not control Esri’s independent processing.

6. International processing

Providers may process data outside Kazakhstan or your country. Where required, we use contractual or other legally recognized safeguards and limit transfers to what is necessary for the purposes above.

7. Retention and security

We retain personal data only for as long as needed to provide the service, secure it, resolve disputes, and meet legal obligations. Retention periods depend on the type of record and why it is held. We use technical and organizational safeguards, including access controls, password hashing, short-lived access credentials, rotating sessions, and restricted media grants. No internet service can guarantee absolute security.

8. Your privacy rights

Subject to applicable law, you may ask to access, correct, update, delete, restrict, or receive a copy of your personal data; object to certain processing; withdraw consent; and complain to the competent data-protection authority. Some records may be retained where law or security obligations require it.

Send a signed request identifying your account and request to our registered address above. We may verify your identity before acting. We will not ask for your password.

9. Children

ORNA Atlas is not directed to children under 16, and we do not knowingly create accounts for them. A parent or guardian who believes a child provided personal data should contact us.

10. Changes to this policy

We may update this policy as the service or law changes. The date above identifies the current version. Material changes may also be presented through the service when appropriate.

Use of ORNA Atlas is also governed by our Terms of Use.