Confidentiality Policy regarding the
Services of UD Capital JSC

This Confidentiality Policy (hereinafter referred to as “Policy”) has been developed in accordance with the legislation of the Republic of Kazakhstan and the internal documents of UD Capital Joint-Stock Company (hereinafter referred to as “Company”) and determines the procedure of processing and protection of information on the use of personal data and other information that the Company receives about the User when using the Company’s services.

1. Definition of Terms:

The following terms shall be used in this Confidentiality Policy:

• “Company’s Services” means mobile applications, web interface, website of the Company that allow users of the Company’s Services to interact with the Company within the framework of the concluded brokerage service agreement or without concluding such a contract,
  as well as interaction with the Company’s partners within the framework of contracts concluded between Users and these partners, including the exchange of information and the performance of certain operations via the Internet or a special application of a mobile device (smartphone, tablet, etc.), as well as an electronic payment system that allows users of mobile devices to make money transfers via the Internet. The Company’s Services are both the Company’s own Services and the Services of the Company’s Shareholder.
• “User” is a person who has access to the Company’s Services via the Internet and uses the Company’s Services.
• “Personal data” is information relating to an identified or identifiable subject of personal data and stored on electronic, paper and (or) other tangible media.
• “Collection of personal data” means actions aimed at obtaining personal data.
• “Processing of personal data” means any action (operation) or set of actions (operations) which is performed with or without the use of automation means with personal data, such as collection, recording, systematisation, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, making available, access), depersonalisation, blocking, deletion, destruction of personal data.
• “Confidentiality of personal data” is a regulation that obliges the Company or any other person who has access to personal data not to authorise its disclosure without the consent of the data subject or another legal basis.
• “User Information” is personal information that the User independently provides to the Company when using the Company’s Services, when creating an account, registering, as well as automatically transmitted data during the use of the Company’s Services.

2. The purpose of this Policy shall be to ensure adequate protection of information about Users, including their personal data, from unauthorised access and disclosure, as well as compliance with the legislation of the Republic of Kazakhstan in the field of personal data protection.
3. The personal data that may be processed under this Confidentiality Policy shall be provided by the User by completing the registration form in the mobile application and include the following information:

• Surname, name, patronymic (if any) of the User;
• Individual identification number (hereinafter referred to as IIN);
• User’s contact phone number;
• User’s electronic mail (e-mail) address;
• Any other personal information about the User not mentioned above.

4. The use of the Company’s Services shall mean that the User unconditionally accepts this Policy and the conditions for the processing of information obtained from the User’s device. The Company shall not control and be not responsible for the information (consequences of its transfer) transmitted by the User to a third party, if such transfer was performed on a third-party resource to which the User was able to access via links from the Company’s Services.

The Company has no control over the content posted, transmitted and used by the User on the Company’s Application and does not initiate the transmission of such content and/or other information posted by the User on the Company Application and is not responsible for them.

The processing of the User’s personal data shall be carried out
in accordance with the legislation of the Republic of Kazakhstan. In accordance with this Policy, the Company shall process the User’s personal data for the following purposes:

• providing the User with access to the Company’s Services;
• confirmation of the accuracy and completeness of the personal data provided by the User;
• providing the User with information about the services offered by the Company, special offers and other information on behalf of the Company;
• carrying out marketing and other studies, including with the help of third party experts (third parties).

5. Furthermore, within the scope of this Policy, the Company shall have the right to use additional software tools to collect and process anonymised statistical information about the use of the Company’s Services and the services within the Company’s Services by the User in order to improve the Company’s Services.
6. When using User’s data, the Company shall comply with this Confidentiality Policy and the requirements of the Law of the Republic of Kazakhstan dated 21 May 2013, No. 94-V “On Personal Data and their Protection”, as well as international treaties ratified by the Republic of Kazakhstan. This Confidentiality Policy has been developed in accordance with their norms.
7. The processing of the User’s personal data shall be carried out without time limitation and by any lawful means, including in information systems for personal data with or without the use of automation tools.

Conditions for the Processing of User’s Information The Company shall take all organisational and technical measures dependent on the Company to protect User’s Information from unauthorised access, use, duplication and disclosure by third parties.

8. For the purposes set out in this Policy, the Company may entrust the processing of the User’s anonymised statistical data to partners with whom the Company has concluded appropriate confidentiality agreements. The Company transmits anonymised data about the use of the Company’s Services to its partners for the purpose of improving the Company’s Services on the basis of agreements with the partners. The Company shall collect and process the entire amount of anonymised data of User’s information required to work with the Company’s Services.

The user’s data shall be stored for the duration of the contractual relationship between the Company and the User, including the Company’s Services, as well as for 5 years after the cancellation of these contracts. The User’s information may be disclosed to government authorities in accordance with the requirements of the applicable legislation.

9. The User confirms that:

• he/she indicates accurate information about himself/herself, all other information is provided by the User at his/her own discretion and with his/her full consent and authorisation;
• he/she is familiar with the terms and conditions of this Policy and agrees to it;
• by continuing to use the Company’s website and mobile application, he/she consents to the collection and processing of personal data;
• by signing with an electronic digital signature and/or using biometric and/or dynamic means of identification, the User consents to the collection and processing of personal data;

10. The Company shall have the right to amend this Policy by posting the new version of the Policy on the Company’s website and/or mobile application. The User shall be obliged to familiarise himself/herself with the current version of the Policy. The new version of the Policy shall come into force from the moment of its publication.
11. If the User does not agree with the Policy, he/she shall refrain from using the Company’s Services. This Policy shall apply only to the Company’s Services.