PRIVACY POLICY

1. General Provisions

1.1. This Privacy Policy (hereinafter referred to as the "Policy") defines the procedure and conditions for the collection, processing, and protection of personal data of users of the internet resource located on the Internet at https://cryptoindustry.kz, including all its pages, subdomains, and language versions (hereinafter referred to as the "Website").

1.2. The owner and operator of the database containing personal data of the Website users is the Association of Legal Entities "Fintech, Artificial Intelligence and Crypto Industry Association of Kazakhstan", BIN 210340017197, registered address: Apartment 17, Building 6, Shaimerden Qoshshygululy Street, Saryarka District, Astana, 010000, Republic of Kazakhstan (hereinafter referred to as the "Association", "Operator").

1.3. The Policy is developed in accordance with the Constitution of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan dated May 21, 2013 No. 94-V "On Personal Data and their Protection" (hereinafter referred to as the "Law on Personal Data"), the Digital Code of the Republic of Kazakhstan dated January 9, 2026 No. 255-VIII, other regulatory legal acts of the Republic of Kazakhstan and is an integral part of the Website Terms of Use.

1.4. By using the Website, filling out and submitting the forms placed on it and (or) subscribing to the newsletter, the User confirms that they have read the Policy, accept its terms, and consent to the collection and processing of their personal data on the terms set forth in the Policy. If the User does not agree with the terms of the Policy, they must refrain from using the Website and providing personal data.

1.5. The current version of the Policy is permanently available at: https://cryptoindustry.kz/en/privacy.

2. Terms and Definitions

Personal data - information relating to a subject of personal data identified or identifiable on its basis, recorded on electronic, paper, and (or) other material media.

Subject of personal data (User) - an individual to whom personal data relates.

Collection of personal data - actions aimed at obtaining personal data.

Processing of personal data - actions aimed at accumulation, storage, modification, addition, use, distribution, depersonalization, blocking, and destruction of personal data.

Depersonalization - actions that make it impossible to determine the ownership of personal data by a subject.

Blocking - actions to temporarily suspend the collection, accumulation, modification, addition, use, distribution, depersonalization, and destruction of personal data.

Destruction - actions that make it impossible to restore personal data.

Cross-border transfer - transfer of personal data to the territory of foreign states.

Cookies - small text files saved by the browser on the User's device when visiting the Website.

3. Composition of Processed Personal Data

3.1. When filling out forms on the Website (membership application, feedback form, event registration, newsletter subscription), the Operator may collect the following data: last name, first name, patronymic (if any); name of the represented organization and job title; email address; phone number; content of the inquiry or application; other information voluntarily provided by the User.

3.2. When visiting the Website, technical data may be collected automatically: IP address, cookie data, information about the browser, device, and operating system, date and time of access, addresses of visited pages. Such data is used in aggregate and (or) depersonalized form for statistical purposes and to improve the operation of the Website.

3.3. The Operator does not purposely collect biometric data and other sensitive categories of personal data through the Website. The User should not send through the Website forms any information not requested by the Operator and excessive for the purposes of the inquiry.

4. Purposes of Collection and Processing of Personal Data

4.1. Personal data is processed for the following purposes: receipt and consideration of applications for membership in the Association, including legal and compliance reviews of applicants; providing feedback on User inquiries; sending informational newsletters (digests, analytical materials, event announcements) if subscribed; organizing and conducting events of the Association, registration and tracking of participants; keeping traffic statistics, improving the operation and content of the Website; compliance with the requirements of the legislation of the Republic of Kazakhstan.

4.2. Processing of personal data is limited to the achievement of predetermined and declared purposes. Personal data is not used for purposes incompatible with the purposes of their collection.

5. Legal Grounds for Processing. Consent

5.1. The ground for the collection and processing of personal data is the consent of the subject of personal data, provided in accordance with Articles 7 and 8 of the Law on Personal Data, including by performing conduct indicative of consent (conclusive actions): checking the corresponding box, filling out and sending a form on the Website, confirming a subscription to the newsletter.

5.2. Collection and processing of personal data without the consent of the subject are carried out only in cases directly provided for by Article 9 of the Law on Personal Data.

5.3. Consent is valid until the purposes of processing are achieved or until it is withdrawn by the subject of personal data, whichever occurs earlier.

5.4. The User has the right to withdraw consent at any time by sending a request to the email address info@cryptoindustry.kz or to the registered address of the Operator. The withdrawal of consent does not have retroactive effect and does not apply to cases where the processing of personal data is mandatory in accordance with the laws of the Republic of Kazakhstan. Opting out of the newsletter is also possible via the unsubscribe link contained in each email.

6. Procedure, Conditions, and Terms of Processing. Storage

6.1. The processing of personal data is carried out with or without the use of automation tools and includes: collection, accumulation, storage, modification, addition, use, distribution (within the limits established by the Policy and legislation), depersonalization, blocking, and destruction.

6.2. The storage of personal data is carried out by the Operator in a database stored on the territory of the Republic of Kazakhstan, in accordance with Article 12 of the Law on Personal Data.

6.3. Personal data is stored no longer than required by the purposes of their processing, unless another storage period is established by the legislation of the Republic of Kazakhstan. Upon achievement of the processing purposes, withdrawal of consent, or expiration of the storage period, personal data is subject to destruction or depersonalization.

7. Transfer of Personal Data to Third Parties. Cross-border Transfer

7.1. The Operator does not sell the personal data of Users and does not transfer them to third parties for marketing purposes.

7.2. Transfer of personal data to third parties is permitted: to providers of technical services (hosting providers, email delivery services, event registration services) - in the volume minimally necessary for the respective purpose, provided they assume obligations to ensure the confidentiality and protection of personal data; to state bodies of the Republic of Kazakhstan - on the basis of their legal requests in cases established by the legislation of the Republic of Kazakhstan; to other persons - with the separate consent of the subject of personal data.

7.3. Cross-border transfer of personal data is carried out in accordance with Article 16 of the Law on Personal Data: to the territory of foreign states providing protection of personal data, and in other cases - with the consent of the subject of personal data or on other grounds provided for by the specified article.

8. Rights of the Subject of Personal Data

8.1. The subject of personal data has the right to: know about the existence of their personal data with the Operator and receive information concerning its processing; request modifications and additions to their personal data; request blocking of personal data in case of information about violation of the conditions of their collection and processing; request destruction of personal data, the collection and processing of which were carried out in violation of the legislation; withdraw consent to the collection and processing of personal data; protect their rights and legitimate interests, including appealing to the authorized body in the field of personal data protection of the Republic of Kazakhstan and (or) court; exercise other rights provided for by the Law on Personal Data.

8.2. To exercise their rights, the User sends a request to the email address info@cryptoindustry.kz or in writing to the registered address of the Operator. Inquiries are considered in the order and terms established by the legislation of the Republic of Kazakhstan.

9. Measures to Protect Personal Data

9.1. The Operator takes necessary legal, organizational, and technical measures to protect personal data in accordance with Articles 20 and 21 of the Law on Personal Data, including: limiting the circle of persons having access to personal data; appointing a person responsible for organizing the processing of personal data; using a secure connection (HTTPS) when transferring data through Website forms; applying information security tools and internal procedures preventing unauthorized access, loss, modification, and distribution of personal data.

9.2. The User understands that the transfer of information via the Internet cannot be guaranteed to be secure from access by third parties at all stages of transmission, and independently takes reasonable precautions when transmitting data via open communication channels.

10. Personal Data of Minors

10.1. The Website is not addressed to persons under the age of eighteen. Personal data of minors may be processed only with the consent of their legal representatives in the manner established by the Law on Personal Data.

11. Cookies

11.1. The procedure for using cookies and similar technologies on the Website is determined by the Cookie Policy available at: https://cryptoindustry.kz/en/cookies, which is an integral part of this Policy.

12. Changes to the Policy

12.1. The Operator has the right to unilaterally modify the terms of the Policy. The new version comes into force from the moment it is posted on the Website, unless another term is specified upon publication. The effective date of the current version is indicated at the beginning of the Policy text.

12.2. Continued use of the Website after the changes come into force constitutes the User's consent to the new version of the Policy.

13. Final Provisions

13.1. Questions related to the processing of personal data shall be sent to the email address info@cryptoindustry.kz.

13.2. The Policy is published in Kazakh, Russian, and English. In case of discrepancies between the language versions, the Russian version shall prevail.

13.3. To relations not regulated by the Policy, the legislation of the Republic of Kazakhstan shall apply.

14. Operator Details

Association of Legal Entities "Fintech, Artificial Intelligence and Crypto Industry Association of Kazakhstan"

BIN: 210340017197

Registered address: Apartment 17, Building 6, Shaimerden Qoshshygululy Street, Saryarka District, Astana, 010000, Republic of Kazakhstan

Head: Kenzhebayev Bakhytzhan Ardakovich

Email: info@cryptoindustry.kz

Phone: +7 747 915 5800

Website: https://cryptoindustry.kz