Privacy policy

Privacy policy

Revised October 13, 2026. The previous version is superseded as of the date of publication of this version.

This policy describes what personal data is collected on the bakertilly-ca.com website, who processes it and for what purposes, where it is stored, to whom it is disclosed, how long it is retained, and how you can exercise your rights. This policy applies to all regional sections of the website (Central Asia, Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan), its Russian and English versions, the “Training” section, and Baker Tilly Academy programs, including online courses, final exams, and the certificate verification page.

This policy does not apply to websites linked from our site: the global website of the Baker Tilly International network, social media platforms, and Google services. Each of these has its own privacy policy.

1. Who Processes Your Data

This website brings together member firms of the Baker Tilly International network operating in Central Asian countries. Each firm is a separate legal entity and is independently responsible for the processing of personal data in its operations. Baker Tilly International Limited does not process the data you submit through this website.

• Website Operator and Baker Tilly Academy — Baker Tilly Bishkek LLC, Kyrgyz Republic, Bishkek, 103 Ibraimova St., “Victory” Business Center, 7th floor. The operator administers the website, its server, forms, certificate registry, online courses, and final exams.
• Firms in Central Asian countries process data from inquiries addressed to them after the website operator forwards the inquiry to them: Kazakhstan — Baker Tilly Qazaqstan LLP and Baker Tilly Qazaqstan Advisory LLP (contact@bakertilly.kz); Kyrgyzstan — Baker Tilly Bishkek LLC (contact@bakertilly.kg); Tajikistan — Baker Tilly Tajikistan LLC (contact@bakertilly.tj); Turkmenistan — Baker Tilly Turkmen LLC (contact@bakertilly.tm); Uzbekistan — Baker Tilly Tashkent Audit LLC, Baker Tilly Tashkent Valuation LLC, Baker Tilly Belasco Audit LLC (contact@bakertilly.uz).

Contact for questions regarding personal data and security: security@bakertilly.kg. Inquiries sent to this address are handled by the person responsible for organizing the processing and protection of personal data—the head of the Information Technology Department at Baker Tilly Bishkek LLC.

2. Principles

• We collect only the data necessary for a specific purpose and use it only for that purpose.
• You can use the website, read materials, and take the Academy’s online courses without providing any personal information. Data is requested only when you submit an inquiry, register for a course, or request a certificate.
• We do not sell personal data or transfer it to third parties for their own marketing purposes.
• The only decision made automatically is the result of the online course’s final test: it is determined by the server according to the rules published on the test page. If you disagree with the result, please contact us, and an Academy staff member will review it.
• We do not upload your personal data to publicly available artificial intelligence services, nor do we use it to train AI models.
• We do not collect special categories of personal data (information about health, beliefs, biometrics, etc.). Please do not include such information in messages sent through the website.

3. What Data We Process and Why

3.1. Inquiries via the “Contact” Form

Data: name, email address, selected country of office, message text, and anything else you include in it.
Purpose: to answer your question and, if you wish, to prepare a proposal for the provision of services.
Legal basis: your consent, which you provide by checking the consent box before submitting the form.
To whom the data is disclosed: the Baker Tilly firm in the country you selected on the form.

3.2. Service Brief

The “Fill out the brief” link leads to a Google Forms form. The information you enter in the brief is processed on Google LLC’s (U.S.) infrastructure in accordance with Google’s policies and becomes available to us for preparing a proposal. If you do not wish to use Google’s service, please send the same information by mail to the address of your country’s office (Section 1).

3.3. Job Applications

If you submit a resume, we will use it to consider your application for the position to which you applied. If you would like your resume to be considered for other positions as well, please indicate this in your letter.

3.4. Baker Tilly Academy: Training and Certifications

Registration for in-person training. We process your last name, first name, patronymic, contact phone number, email address, place of employment, and job title to enroll you in the course, contact you, and process documents and invoices.

Certificates. Upon completion of the training, the Academy issues certificates and maintains a registry of them. The registry contains: the certificate number; last name, first name, and patronymic, as well as their transliteration into the Latin alphabet; gender—solely for grammatical agreement in the text of the certificate; course title and dates of study; date of issuance and certificate status; distinction, if awarded; final assessment result; email address for sending the certificate; date of birth, if provided during registration. The date of birth is stored in encrypted form and is used only to verify identity when downloading the certificate.

Publication of learning outcomes. Anyone, such as your employer, can verify the authenticity of any certificate on the “Certificate Authentication” page using the number or QR code from the certificate. The verification page displays only the information printed on the certificate itself: the certificate number, last name, first name, and patronymic (in both Cyrillic and Latin script), course title, training dates, date of issuance, status, and distinction. Your date of birth, scores, and email address are not displayed on the verification page. It is impossible to find information about you without the certificate number: the page does not allow searching by last name.

Legal basis: the training agreement or your consent; for online courses—the consent you provide when requesting a certificate (Section 3.5). The publication of information on the verification page is a condition for issuing the certificate, since the certificate cannot be verified without it.

3.5. Online Courses and Final Tests

• The course is taken anonymously. Your progress and quiz answers are stored only in your browser (Section 4) and are not transmitted to the server.
• Final test. The server stores information about your attempt: the questions asked, your answers, the result, the time, the country-specific version of the course, and an irreversibly transformed (hashed) IP address from which the original address cannot be recovered. This information is necessary to ensure compliance with test rules (number of attempts per day, time between attempts, time limit) and to prevent abuse. Records of test attempts are automatically deleted after 30 days.
• Online Course Certificate. You provide your last name, first name, middle name, gender, and email address only after successfully passing the test and only if you wish to receive a certificate. The certificate is issued subject to your agreement to this policy. The information is entered into the certificate registry (Section 3.4). To prevent duplicate issuance, an irreversibly hashed version of the email address is stored.

3.6. Technical Data and Security

When you visit the website, the server automatically collects technical information: IP address, browser type, requested page, and time of the request. This information is used to operate and secure the website, including to limit the frequency of requests to forms, tests, and the certificate verification page. Request counters are stored as hashed values and are deleted after 10 minutes.

4. Cookies and Browser Storage

Cookies are small files that the website stores in your browser. Browser storage (localStorage) works in a similar way. We use them as follows.

We do not use advertising cookies or integrate social media pixels on our website. Links to our pages on social media are standard links and do not transmit any information about you until you click on them. You can withdraw your consent to analytical cookies by deleting the website’s cookies in your browser settings: the notification will reappear on your next visit.

5. Where Data Is Stored and Transfer Abroad

The website server, certificate registry, and online course data are located in the Kyrgyz Republic. If you are in another country, the data you submit through the website is transferred to the Kyrgyz Republic. Any inquiry addressed to an office in another country is forwarded by the website operator to the Baker Tilly office in that country. Brief data and analytical data are processed by Google LLC in the United States and other countries.

By submitting a form or requesting a certificate, you consent to such cross-border transfers. We transfer data only to the extent necessary for the purpose and only to organizations that are obligated to maintain its confidentiality.

6. To Whom We Transfer Data

• Baker Tilly firms in Central Asian countries—to respond to inquiries addressed to them (Section 1).
• Service providers acting on our behalf and bound by confidentiality obligations: website hosting, email service for sending certificates and responses, Google (briefing, analytics). These providers are not permitted to use the data for their own purposes.
• To government agencies—only in cases and in the manner expressly provided for by law.

7. How Long We Retain Data

Upon expiration, the data is deleted or anonymized so that it can no longer be linked to you. If the laws of the country where Baker Tilly operates require longer retention of documents, the period established by law applies.

8. Your Rights

In accordance with your country’s personal data laws, you have the right to:

• obtain information about what data we process about you and a copy of that data;
• request the correction of inaccurate data, including the spelling of your name on the certificate;
• withdraw your consent and request the deletion of your data. If you withdraw your consent to the processing of data in the certificate registry, the entry will be deleted and the certificate will no longer pass authenticity verification;
• object to the processing and request that it be restricted;
• appeal our actions to the authorized personal data protection authority in the country where you are located, or in court.

To exercise your rights, please contact us at security@bakertilly.kg or your country’s office. To ensure we do not disclose your data to third parties, we may ask you to verify your identity—for example, by sending a request from the email address provided during registration or by providing your certificate number. We will respond within the timeframes established by the laws of your country.

9. Applicable Law

The processing of personal data is carried out in accordance with the laws of the country in which the relevant Baker Tilly firm operates and the country in which the website’s server is located:

• Kyrgyz Republic — Digital Code of the Kyrgyz Republic;
• Republic of Kazakhstan — Law “On Personal Data and Its Protection”;
• Republic of Tajikistan — Law “On the Protection of Personal Data”;
• Turkmenistan — Law “On Information Regarding Private Life and Its Protection”;
• Republic of Uzbekistan — Law “On Personal Data”.

If the laws of the country where you are located establish a higher level of protection, we apply those standards.

10. How We Protect Data

• Data transmission between your browser and the website is encrypted (HTTPS).
• Your date of birth is stored in encrypted form in the certificate registry; the encryption key is stored separately from the database.
• IP addresses and email addresses, where they are needed solely to prevent abuse, are stored in an irreversibly transformed form.
• Final test answers are verified on the server; the answer key is not transmitted to the browser.
• Only employees who need the data to perform their duties have access to it. All employees are required to maintain confidentiality.
• The frequency of requests to forms, tests, and the verification page is limited to protect against automated brute-force attacks.

In the event of a personal data breach, we will notify the authorized authority and, when required by law, you—within the timeframes established by law.

11. Minors

The Academy’s website and programs are intended for adults. If you are under 18 years of age, please submit inquiries and register for training with the consent of your parents or other legal guardians.

12. Policy Changes

We review this policy when there are changes to the law, the website’s content, or our data processing procedures. The updated version is published on this page with the date indicated. If the changes affect data you have already provided based on your consent and require new consent, we will request it separately.