🔒 Privacy Policy — OBC / obcface.com

1. Definitions

• "Platform" means obcface.com and related pages, apps (if any), and services.
• "User" means any visitor, registered member, participant, voter, or referrer.
• "Personal Data" means any information relating to an identified or identifiable person.
• "Controller" means the entity that determines the purposes and means of processing.
• "Processor" means a third party processing data on behalf of the Controller.
• "Content" means photos, videos, text, comments, messages, and submissions uploaded by Users.

2. Who We Are (Controller) and Scope

The Platform is operated by Individual Entrepreneur “OBC faces” (sole proprietor: Elmira Asanova), registered in the Republic of Kazakhstan, IIN 811012402199, registered address: 77 Karibzhanova St., Medeu District, Almaty, Republic of Kazakhstan — referred to in this Policy as “OBCFaces”, “we”, “us”.

OBCFaces acts as the data controller for Personal Data processed in connection with the Platform.

This Policy covers:

• account registration and login,
• browsing and voting,
• participation in any contest and prize-related processing,
• referral program and reward tracking,
• safety, moderation, and anti-fraud measures,
• marketing communications (only with consent where required),
• promotional and advertising use of your contest photos, videos, Finalist Diary clips and reels, and live streams and their recordings under the Contest Terms media license — including broadcasting and publication on our official accounts on third-party platforms such as Instagram, Facebook, TikTok, and YouTube (this is separate from marketing-communication consent),
• analytics and platform improvements,
• legal compliance.

3. Eligibility and Minors (18+ Only)

The Platform is intended for adults only. You must be at least 18 years old to create an account, upload Content, or participate in any contest.

We do not knowingly collect Personal Data from minors. If we learn that a user is under 18, we may suspend/terminate the account and delete data, except where retention is required by law or for safety/fraud prevention.

4. Data We Collect

We collect data you provide, data generated by your use of the Platform, and data we receive from partners when necessary to operate the service.

4.1 Account Data

• email address
• username/display name
• encrypted password (we do not store plain-text passwords)
• account IDs, authentication tokens/sessions

4.2 Profile Data (optional fields depending on your choices and contest requirements)

• gender, age/date of birth (or age bracket)
• height
• country/city of residence
• biography/about text and other profile fields you submit

4.3 Content Data (UGC)

• photos (face and/or full-body)
• videos
• live streams and their recordings (when you host or appear in one)
• submissions to contests and categories
• comments/ratings/likes/dislikes and other interactions

4.4 Messaging and Support

• messages sent through the Platform (where available)
• support requests and correspondence (including attachments you send)

4.5 Usage & Technical Data

• IP address
• device identifiers and attributes, browser type, OS version
• timestamps, logs, pages visited, referring URLs
• language settings, approximate location (derived from IP)
• performance diagnostics and error reports

4.6 Cookies & Similar Technologies

cookies, local storage, pixels, and similar technologies used for login, preferences, security, analytics, and (where applicable) advertising. See Cookie Policy for details.

4.7 Referral Program Data

• referral codes/links and attribution events
• reward eligibility signals (e.g., referred user registration/participation)
• anti-abuse signals to prevent referral fraud

4.8 Prize, Verification, and Compliance Data (only when needed)

If you win, claim a prize, or if we need to verify eligibility or prevent fraud, we may request:

• legal name, contact details, and shipping address (if applicable)
• payment details (e.g., payout account identifiers)
• identity verification documents (government ID) and/or age verification
• tax-related information where required by law

4.9 Special Categories of Data (Sensitive Data)

Depending on what you upload, your Content may include sensitive information (e.g., health-related visible features, ethnicity, religious symbols). We do not require such information and ask you not to upload sensitive personal data. If you choose to upload it, you do so voluntarily as part of UGC, and it may become public depending on your settings and contest rules.

4.10 Biometric Data / Face Data Notice

Photos and videos of faces are personal data. We do not claim ownership of your face or identity.

Today we do NOT perform facial recognition, do not create face-geometry templates or other biometric identifiers, and do not use your face to identify you. Automated tools are used only to moderate content against our rules, to crop, and to resize images. We do not sell any data derived from your face.

We may in the future introduce automated face-similarity or duplicate-detection tools to prevent fake or duplicate accounts, detect stolen or reused images, and protect contest integrity. Before we apply any such biometric processing to your data, we will obtain your explicit, separate consent where required by law (for example, Illinois BIPA, Texas CUBI, or GDPR Article 9), update this Policy, and apply a published retention and destruction schedule. We will not run biometric matching on your data until you have given any consent the law requires.

5. How We Use Data (Purposes)

We use Personal Data to:

• create and manage accounts; authenticate users; provide customer support
• operate contests: receive submissions, calculate results, show rankings, announce winners
• display Content and profiles according to your settings and contest rules
• enable voting/ratings and prevent manipulation
• run referral program attribution and prevent abuse
• detect, investigate, and prevent fraud, spam, and policy violations
• maintain safety and integrity: moderation, security monitoring, and incident response
• improve the Platform: analytics, debugging, feature development, performance optimization
• communicate with you: service messages, results, rule changes, security alerts
• send marketing messages only where permitted and/or with your consent
• comply with legal obligations and enforce our Terms and Rules (including handling complaints and rights requests)

6. Legal Bases for Processing (GDPR/UK GDPR Style)

Where GDPR/UK GDPR applies, we process data under these bases:

• Contract: to provide the Platform and run contests you enter
• Consent: where required (e.g., marketing communications, certain cookies, and certain sensitive processing depending on jurisdiction)
• Legitimate Interests: security, fraud prevention, platform integrity, analytics, and improvements, balanced against your rights
• Legal Obligation: tax, accounting, lawful requests, and other legal compliance
• Vital Interests/Public Interest: where necessary to protect users or the public, or as required by law

You may withdraw consent at any time, but processing based on other legal bases may continue if lawful.

7. Public Nature of Content and Visibility Controls

7.1 Public Content

Contest submissions, rankings, and certain profile elements may be public by design. If you submit Content to a contest, you understand it may be viewed, shared, and embedded by other users and the public (including via screenshots) to the extent allowed by the Platform's features.

Public Content and public profile elements are made available to an unlimited number of persons and are visible to users worldwide, in any country — including outside your country of residence or citizenship. Public pages may be indexed and cached by search engines. By submitting Content to a contest or making profile elements public, you consent to this publication and worldwide distribution. If you do not want information to be public, do not include it in public Content.

7.2 Minimization

We encourage you not to publish phone numbers, home addresses, sensitive information, or third-party data in your Content.

7.3 Removal

You may delete your account and request deletion of certain data (see Section 11). Some Content may remain if required to maintain contest integrity, resolve disputes, comply with law, or where technically necessary (e.g., backups for limited periods). We may also retain evidence for fraud/safety investigations.

8. Automated Processing and Profiling

We may use automated systems to:

• detect spam and abusive behavior,
• detect suspicious voting patterns,
• identify duplicated or stolen content,
• prioritize moderation queues.

These systems are designed to protect the Platform. They do not produce legal effects on you without human review where required by law. You may contact us to contest a decision that affects your account or participation.

9. Sharing and Disclosure of Data

We do not sell your personal data.

9.1 Service Providers (Processors)

Providers that help us operate the Platform, such as:

• hosting/infrastructure and storage
• analytics and monitoring
• email and communications
• payment/payout providers (for prizes/referrals)
• moderation and security tooling

These providers process data under contracts and confidentiality obligations.

9.2 Legal and Safety Disclosures

We may disclose data:

• if required by law, court order, or valid government request
• to protect rights, safety, and security of users and the Platform
• to investigate fraud, abuse, or violations
• in connection with a business transfer (merger/acquisition/asset sale), subject to lawful safeguards

9.3 International Operations

Data may be accessed by personnel or vendors in multiple countries solely as necessary to operate the Platform.

10. International Data Transfers

Your data may be stored or processed in countries other than your own.

Where required by law, we implement appropriate safeguards for cross-border transfers, such as:

• Standard Contractual Clauses (SCCs) or equivalent mechanisms
• contractual and technical protections with processors
• security measures described in this Policy

11. Your Rights and Choices

Depending on your location, you may have rights under laws such as GDPR/UK GDPR, CCPA/CPRA, and other national laws.

You may request:

• Access: a copy of your Personal Data
• Correction: fix inaccurate data
• Deletion: erase data (subject to legal and legitimate retention needs)
• Restriction/Object: limit or object to certain processing
• Portability: receive data in a structured format (where applicable)
• Withdraw Consent: for consent-based processing
• Appeal: challenge certain decisions, including moderation actions (where applicable)

How to exercise rights:

Email support@obcface.com with your request. We may ask for verification to protect your account.

To request erasure of your data specifically, see our Data Deletion & Erasure Request page.

California notice (CCPA/CPRA):

• We do not sell or "share" personal information for cross-context behavioral advertising as defined by CPRA, unless explicitly stated with opt-out options.
• California residents have the right to know, correct, delete, and limit the use and disclosure of sensitive personal information, as well as the right to non-discrimination for exercising these rights.
• Where we use automated decision-making technology (for example, automated content moderation or vote-validation systems), California residents may request meaningful information about the logic involved and may opt out where the law requires.
• To submit a request, email support@obcface.com. You may also lodge a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General.

Philippines notice (Data Privacy Act of 2012 / RA 10173):

• You may exercise the rights to be informed, to access, to object, to erasure or blocking, to damages, to data portability, and to rectification, as provided in Sections 16 and 18 of the Data Privacy Act.
• Sensitive personal information is processed only with the criteria set out in Section 13 (consent, contract, legal obligation, vital interests, public order, or legitimate interests of a non-commercial nature).
• You may file a complaint with the National Privacy Commission (NPC, https://privacy.gov.ph) if you believe your rights have been violated.

Russian Federation notice (Federal Law No. 152-FZ):

• Personal data may be processed and stored on servers located outside the Russian Federation. By creating an account and submitting your data, you consent to this cross-border processing. We rely on your consent and the safeguards described in this Policy, and we honor the data-subject rights set out below.
• Russian users may withdraw consent at any time by writing to support@obcface.com, subject to the restrictions allowed by Russian law (for example, fraud prevention or tax records).
• Complaints may be addressed to Roskomnadzor (the Russian Federal Service for Supervision of Communications, Information Technology, and Mass Media).

Ukraine notice (Law No. 2297-VI on Personal Data Protection):

• Ukrainian users have the rights set out in Article 8 of Law No. 2297-VI, including the right to be informed of processing, to access and correct data, and to demand erasure of data processed in violation of the law.
• Complaints may be addressed to the Ukrainian Parliament Commissioner for Human Rights (Office for Personal Data Protection).

Kazakhstan notice (Law No. 94-V on Personal Data and Their Protection):

• Personal data may be processed and stored on servers located outside the Republic of Kazakhstan. By creating an account and submitting your data, you consent to this cross-border processing, and we apply the safeguards described in this Policy.
• Kazakhstani users may access, correct, block, or delete their data and withdraw consent by writing to support@obcface.com, subject to the restrictions allowed by Kazakh law (for example, fraud prevention or tax records).
• Complaints may be addressed to the Personal Data Protection Committee under the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan.

Kyrgyzstan notice (Law No. 58 on Personal Information):

• Personal data of users in the Kyrgyz Republic is processed in accordance with Law No. 58 "On Personal Information" (as amended). Cross-border transfer of personal data is carried out only to jurisdictions that ensure adequate protection or under the safeguards described in this Policy.
• Kyrgyz users have the right to be informed about processing, to access and correct their data, and to withdraw consent by writing to support@obcface.com, subject to the restrictions allowed by law.
• Complaints may be addressed to the authorized state body for personal data protection of the Kyrgyz Republic (the State Agency for Personal Data Protection).

Brazil notice (LGPD — Law No. 13,709/2018):

• You may exercise the rights in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation or deletion, data portability, and information about the parties with whom your data is shared.
• To exercise these rights or withdraw consent, email support@obcface.com.
• Complaints may be addressed to the Autoridade Nacional de Proteção de Dados (ANPD, https://www.gov.br/anpd).

Nigeria notice (Nigeria Data Protection Act, 2023):

• You have the rights to be informed, to access, to rectification, to erasure, to restrict or object to processing, and to data portability under the Nigeria Data Protection Act, 2023.
• To exercise these rights or withdraw consent, email support@obcface.com.
• Complaints may be addressed to the Nigeria Data Protection Commission (NDPC, https://ndpc.gov.ng).

Kenya notice (Data Protection Act, No. 24 of 2019):

• You have the rights set out in the Data Protection Act, 2019, including to be informed, to access, to rectification and erasure, to object to processing, and to data portability.
• To exercise these rights or withdraw consent, email support@obcface.com.
• Complaints may be addressed to the Office of the Data Protection Commissioner (ODPC, https://www.odpc.go.ke).

Ghana notice (Data Protection Act, 2012 / Act 843):

• You have the rights provided under the Data Protection Act, 2012 (Act 843), including to access, correct, and prevent the processing of your personal data.
• To exercise these rights or withdraw consent, email support@obcface.com.
• Complaints may be addressed to the Data Protection Commission of Ghana (https://www.dataprotection.org.gh).

Belarus notice (Law No. 99-Z on Personal Data):

• Users in the Republic of Belarus have the rights set out in Law No. 99-Z "On Personal Data," including to consent and withdraw consent, to be informed of processing, to access their data, and to demand its correction or deletion.
• To exercise these rights, email support@obcface.com.
• Complaints may be addressed to the National Personal Data Protection Centre of the Republic of Belarus.

Other jurisdictions:

Users in the EU/EEA, the United Kingdom, and other countries with comparable data protection laws have equivalent rights and may contact their national supervisory authority. Examples: in the EU/EEA — the national Data Protection Authority of the user's country of residence; in the United Kingdom — the Information Commissioner's Office (ICO).

Do Not Track:

Browsers may send "Do Not Track" signals. There is no uniform standard, so we respond to such signals only where required by law.

12. Data Retention

We keep data only as long as necessary for the purposes described.

Typical retention:

• Account/Profile/Content: while your account is active, and thereafter as needed for backups, dispute resolution, fraud prevention, and legal compliance
• Logs/Analytics: typically up to 13 months (unless needed longer for security investigations)
• Prize/Payment/Tax records: as required by law

Backups: Data may persist in backups for a limited time. We restrict access and delete backups on routine schedules where feasible.

13. Security

We use reasonable administrative, technical, and physical measures to protect data, including:

• encryption in transit where supported
• access controls and least-privilege practices
• monitoring and logging for suspicious activity
• secure hosting/infrastructure configurations

No system is 100% secure. You are responsible for keeping your password confidential and using strong account security practices.

Breach notification. If a personal-data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required by applicable law (e.g., Article 34 GDPR and comparable laws), affected users without undue delay — generally within 72 hours of becoming aware of it. You may report a suspected security issue to support@obcface.com.

14. Cookies and Tracking (High-Level)

We use cookies and similar technologies for:

• essential functions (login, security, preferences)
• analytics and performance
• (where applicable) marketing/advertising, subject to consent laws

Outside the EEA, the UK and Switzerland, analytics and marketing cookies are enabled by default and you can opt out at any time in the cookie settings on our Cookie Policy page; inside those regions they are only set after you accept them.

For full details and choices, see our Cookie Policy.

15. Third-Party Links and Services

The Platform may contain links to third-party websites/services. Their privacy practices are governed by their own policies. We are not responsible for third-party privacy practices.

If you use third-party login or payment services (where available), we may receive limited information necessary to provide the service.

16. Content Ownership vs. Data Processing

Your rights in your Content are governed by our Terms of Service and Rules of Participation. This Privacy Policy explains how we process personal data contained in or associated with that Content.

17. Non-Responsibility for False Information

Users are solely responsible for the legality, accuracy, and truthfulness of information and Content they provide.

We do not guarantee verification of user-provided information. We may take action against false information under our Terms and Rules, including suspending accounts or withholding prizes until verification is completed.

18. Changes to This Policy

We may update this Privacy Policy. We will post the updated version on the Platform and update the "Last Updated" date.

Continued use of the Platform after changes means you accept the updated Policy, to the extent permitted by law.

19. Governing Law

This Privacy Policy is governed by the laws of the Republic of Kazakhstan, WITHOUT prejudice to mandatory consumer and data protection laws that apply to you based on your residence (e.g., GDPR/UK GDPR, CCPA/CPRA, and other local laws).

Disputes shall be handled by competent courts subject to applicable rules on jurisdiction and mandatory legal protections.

20. Contact

For privacy questions, requests, or complaints:

📧 support@obcface.com