Privacy Policy

This Privacy Policy is developed in accordance with the legislation of the Republic of Kazakhstan and the internal documents of Halyk Finance JSC, a subsidiary of Halyk Bank of Kazakhstan (hereinafter referred to as the Company), and regulates the procedure for processing and using personal and other information that the Company receives about the User while using the Company's Services.

1. Definition of Terms

1.1. The following terms are used in this Privacy Policy:

1.1.1. "Company Shareholder" - Halyk Savings Bank of Kazakhstan Joint Stock Company.

1.1.2. "Company Services" - mobile applications, web trading platform, corporate website that allow users of the Company's Services to interact with the Company within the framework of a concluded brokerage service agreement, as well as without concluding such an agreement, and to interact with the Company's partners within the framework of agreements concluded between Users and such partners, including the exchange of information and the execution of certain operations via the Internet or a special application of a mobile device (smartphone, tablet, etc.), as well as an electronic payment system that allows users of mobile devices to make money transfers via the Internet. The Company's Services include both the Company's own Services and Services provided by the Company's Shareholder.

1.1.3. "Personal Data" - any information relating to a directly or indirectly identified or identifiable individual (subject of personal data).

1.1.4. "Processing of Personal Data" - any action (operation) or a set of actions (operations) performed using automation tools or without using such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

1.1.5. "Confidentiality of Personal Data" - a mandatory requirement for the Company or any other person who has access to personal data to prevent their dissemination without the consent of the subject of personal data or the presence of another legal basis.

1.1.6. "User" - a person who has access to the Company's Services via the Internet and uses the Company's Services.

1.1.7. "User Information" - personal information that the User independently provides when using the Company's Services during the creation of an account, registration, as well as automatically transmitted data during the use of the Company's Services, including but not limited to: IP address, information about the mobile device from which access is carried out, etc. When using the Company's Services, the following information may be requested and obtained:

• User Information. When creating an account and/or registering, the Company requests information about the User, for example: IIN (Individual Identification Number), full name, gender, date of birth, address of residence and registration, email address, phone number, place of work, position, photo images and video recordings obtained using the camera, information about the User's contact details (phone and/or address book, contacts on the mobile device), as well as data automatically sent by the web server. The Company may also request additional information.
• Information about the mobile device. The Company collects data about Users' mobile devices, such as the mobile device model, operating system version, unique device identifiers, as well as data about the mobile network and mobile phone number. In addition, the device identifier and mobile phone number may be linked to the User's account.
• Location Information. The Company's Services that support the function of the geographical location of the User's mobile device allow the Company to receive information about the User's actual location, including GPS (Global Positioning System) data sent by the mobile device.
• Information about transactions. When conducting transactions with financial instruments, information operations, money transfers, etc., the Company collects data about the place, time, and amount of transactions, the type of payment method, data about the seller and/or service provider, descriptions of the reason for the transaction, if any, as well as other information related to the execution of the above operations.

2. General Provisions

2.1. Accessing the use of the Company's Services means the unconditional agreement of Users with the provisions of this Privacy Policy. The Company ensures the security of personal information received from Users.

2.2. This Privacy Policy is developed to determine the list of data that may be requested from Users of the Company's Services, as well as methods of processing such data by the Company and other persons.

2.3. This Privacy Policy also specifies the purposes for which Users' personal information may be requested or disclosed.

2.4. Separate agreements with Users may provide for other purposes for which Users' personal information may be requested or disclosed.

2.5. This Privacy Policy also specifies the main precautions that Users should take to ensure that their personal information remains confidential.

2.6. This Privacy Policy applies to information that was received by the Company as a result of the use of the Company's Services by Users.

3. Received and Used User Information and the Purposes of Its Use

3.1. User information is collected by the Company for the purposes of increasing the User's security when using the Company's Services, improving the level of operational protection, protecting information, carrying out technical management of the Company's Services, facilitating the execution of operations by Users, as well as conducting analysis and improving the operation of the Company's Services, providing Users with information about the services provided by the Company and the products offered by the Company, for marketing purposes, and for other purposes specified in this Privacy Policy or the terms of use of individual Company Services.

3.2. The Company may use the User's personal data for the purposes of:

• Identifying the User registered in the mobile application when interacting with the Company within the framework of a concluded brokerage service agreement, as well as without concluding such an agreement.
• Providing the User with access to the Company's Services.
• Establishing feedback with the User, including sending notifications, requests related to the use of the Company's Services, providing services, processing requests and applications from the User.
• Determining the User's location to ensure security and prevent fraud.
• Confirming the accuracy and completeness of the personal data provided by the User.
• Creating an account for conducting transactions.
• Notifying the User about the status of client orders.
• Processing and receiving payments, confirming taxes or tax benefits, disputing payments.
• Providing the User with effective customer and technical support in case of problems related to the use of the Company's Services.
• Providing the User with updates of the Company's products, special offers, information about advertising campaigns, newsletters, and other information on behalf of the Company or on behalf of the Company's Shareholder.
• Providing the User with access to the websites or Services of the Company and the Company's Shareholder for the purpose of obtaining products, updates, and services.

4. Conditions for Processing Information

4.1. When using User Information, the Company is guided by this Privacy Policy, as well as the requirements of the Law of the Republic of Kazakhstan dated May 21, 2013, No. 94-V "On Personal Data and Their Protection," and international treaties ratified by the Republic of Kazakhstan. This Privacy Policy is developed in accordance with their norms.

4.2. The processing of the User's personal data is carried out without a time limit, by any lawful means, including in personal data information systems using automation tools or without using such tools.

5. Providing User Information to Third Parties

5.1. The Company has the right to exchange User Information with the Shareholder, affiliated persons, as well as partners and other companies related to the Company for the purposes specified in Section 3 of this Privacy Policy, except for information constituting commercial secrets in the securities market. In this case, the Company ensures compliance with the current legislation of the Republic of Kazakhstan and this Policy regarding User Information by concluding appropriate agreements that guarantee that the above-mentioned recipients of Information adhere to the appropriate level of protection.

5.2. The Company does not provide User Information to companies and individuals not related to the Company, except in cases where the User has given consent.

5.3. To provide User Information to companies and individuals not related to the Company, including other Users, additional consent from the User is requested in accordance with the current legislation of the Republic of Kazakhstan.

5.4. The Company may provide generalized anonymized data of Users of the Company's Services to partners (for example, for the purpose of conducting statistical, analytical, and other studies). When transferring User Information outside the Republic of Kazakhstan, the Company ensures compliance with the current legislation of the Republic of Kazakhstan and this Policy regarding User Information by concluding agreements that guarantee that the recipients of the Information adhere to the appropriate level of protection.

6. Security Measures Used to Maintain the Confidentiality of Information

6.1. The Company takes all possible measures to ensure the security and protection of User Information from unauthorized attempts to access, modify, disclose, or destroy, as well as other types of improper use.

6.2. In particular, the Company constantly improves methods of collecting, storing, and processing data, including physical security measures, to counteract unauthorized access to the Company's systems for the purpose of theft of property, phishing, and other types of fraud.

6.3. The Company also restricts access to User Information for employees, contractors, and agents, providing strict contractual obligations in the field of confidentiality, for the violation of which measures of responsibility and penalties are provided in accordance with the legislation of the Republic of Kazakhstan.

6.4. The User's personal data may be transferred to authorized state authorities of the Republic of Kazakhstan only on the grounds and in the manner prescribed by the legislation of the Republic of Kazakhstan.

6.5. In case of loss or disclosure of Users' personal data, the Company informs the User about the loss or disclosure of personal data.

6.6. The Company, together with the User, takes all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the User's personal data. For the security of using the Company's Services, the Company recommends that the User follow the following recommendations:

• The User must keep account data, such as login and password, secret from third parties.
• The User is obliged to immediately inform the Company of any case of suspected unauthorized use of their account.

6.7. The User's compliance with the Company's recommendations ensures the maximum safety of the information provided to the Company, including the User's bank card details (or other electronic means of payment), and other data, and also reduces possible risks when conducting operations using bank card details (or other electronic means of payment) for cashless payment of goods and services, including via the Internet.

7. Liability

7.1. The Company, which has not fulfilled its obligations under this Privacy Policy, is liable for losses incurred by the User in connection with the unlawful use of personal data, in accordance with the legislation of the Republic of Kazakhstan, except in cases provided for in paragraphs 5.1, 6.4, and 7.2 of this Privacy Policy.
7.2. In case of loss or disclosure of Confidential Information, the Company is not liable if this confidential information:

• Became public domain before its loss or disclosure.
• Was received from a third party before it was received by the Company.
• Was disclosed with the consent of the User.

8. Dispute Resolution

8.1. Before going to court with a claim for disputes arising from the relationship between the User and the Company, it is mandatory to submit a claim (written proposal for voluntary settlement of the dispute).

8.2. The recipient of the claim within 30 calendar days from the date of receipt of the claim, notifies the claimant in writing about the results of the consideration of the claim.

8.3. If an agreement is not reached, the dispute will be transferred to a judicial body in accordance with the current legislation of the Republic of Kazakhstan.

8.4. The current legislation of the Republic of Kazakhstan applies to this Privacy Policy and the relationship between the User and the Company.

9. Changes to the Privacy Policy

9.1. The Company has the right to make changes to this Privacy Policy without the consent of the User.

9.2. The new Privacy Policy comes into force from the moment of its placement on the Company's corporate website, unless otherwise provided by the new edition of the Privacy Policy. All suggestions or questions regarding this Privacy Policy should be sent to: halykfinance@halykfinance.kz.

9.3. In case the Company has made any changes to the Privacy Policy that the User does not agree with, they are obliged to stop using the Company's Services. The fact of not stopping the use of the Company's Services is confirmation of the User's consent and acceptance of the corresponding edition of the Privacy Policy.

9.4. The current Privacy Policy is posted on the page at: https://halykfinance.kz/privacy-policy/.

9.5. The Company recommends that Users of the Company's Services regularly refer to this Privacy Policy to familiarize themselves with the current edition.