Privacy policy

Policy version: 2026-10-25-consent-v2.

1. Who processes the data

The personal data operator is ИП GLOBAL BOOK OF RECORDS, IIN 680807350271, Astana. This policy describes how we process data in the Global Best of Records (GBR) app, the Admin Panel and the public record registry, under the Law of the Republic of Kazakhstan No. 94-V "On personal data and their protection".

2. What we collect

Account: e-mail address, full name, country, phone, interface language. Record request: first and last name, age, phone, e-mail, the record description; for an applicant under 18, the name and phone of a parent or legal guardian and a note of their consent. Technical data: IP address and browser or device details when you sign in and consent, the device push token if you allow notifications. Registry records: the holder's name, country, the record title and description, result, date and place, photo, certificate number.

3. Why

To review record requests and contact applicants, keep the public registry and issue certificates that can be checked by QR code, send notifications about a request's status, protect the service from abuse and meet legal requirements. We do not sell data or use it for advertising.

4. Legal basis

We process data with your consent, which you give in the app on first sign-in and with every new version of this policy. The consent is recorded with its date, the policy version, the IP address and browser details. For a minor, a parent or legal guardian consents: under 14 they submit the request on the child's behalf, from 14 to 18 they confirm their consent in the request.

5. Publication in the registry

Once a record enters the registry, the holder's name, country, title, result, date, place, photo and certificate number are public. You can hide your name in the profile; the registry then shows "Name hidden". Phone, e-mail, age and the guardian's details are never published. Records imported from the IRWR registry are marked as imported; IRWR is our company's registry.

6. Where the data is stored

The data is stored in a database on servers in the Republic of Kazakhstan.

7. Who receives the data

The e-mail service Resend (USA, servers in the EU) receives your e-mail address and the text of our e-mails. If you allow notifications, Expo's push service (USA) receives your device token and the notification text. These transfers abroad happen only with your consent. We share data with no other third parties, except where the law requires it.

8. How long we keep it

Data is kept while it is needed for the purposes in section 3. Rejected requests are deleted after 12 months. IP addresses in logs are deleted after 12 months. In-app notifications are deleted after 90 days. Registry records and certificates are kept indefinitely, since a certificate has to stay verifiable for years. When you delete your account, we delete the profile and drafts, and remove from your requests the name, age, phone, e-mail and the guardian's details; the description and status stay in GBR's history without a link to you.

9. Your rights

You can learn what data we hold about you, where it came from and how long we keep it; ask us to correct or complete it; ask us to block or delete data collected in breach of the law; withdraw your consent; hide your name in the registry. We make changes or deletions you request within one working day. You can delete your account in the app's profile. Send other requests to globalbestofrecords@gmail.com; every record in the app has a "Report an error or remove my data" button.

10. How we protect it

Only GBR administrators can access the data, and their sign-in is protected by a second factor (TOTP). Data travels over encrypted connections, certificates carry a digital signature, and actions on data are logged.

11. Changes

When the policy changes, we publish the new version on this page and ask for your consent again the next time you open the app. The current version number is shown at the top of this page.

12. Contact

For questions about personal data, write to globalbestofrecords@gmail.com.

Record requests

When you send a record request, we keep the details you give us (name, age, phone, e-mail and description, and for an applicant under 18 the name and phone of a parent or legal guardian) so that GBR staff can review it and contact you. A request is not an official record. A declined request is deleted after the same period as a rejected application. If you delete your account, your name, age, phone, e-mail and the guardian's details are removed from your requests; the description and the status stay in GBR's history.

13. This website

This website itself has no forms, and it uses no cookies and no analytics. Our hosting provider may keep technical request logs. Applications are accepted by phone and email for now; the data you give us when you contact us, such as your name, phone number or e-mail address, is used to review your application and reply to you, and is handled under this policy (sections 2 to 4 apply).