Personal Data Processing Policy

1. General Provisions

This Personal Data Processing Policy (hereinafter — the "Policy") has been developed in accordance with the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 "On Personal Data and Their Protection" (as amended through 2026) and establishes the procedure for collecting, processing, storing, and protecting the personal data of website users.

The personal data operator is Atamura Group LLP (hereinafter — the "Operator", "we"), operating in the Republic of Kazakhstan.

By using the website and completing inquiry forms, you consent to the processing of your personal data in accordance with this Policy.

2. Purposes of Personal Data Collection

The Operator collects and processes personal data exclusively for the following purposes:

• processing applications for the purchase of residential property and providing consultations on real estate projects;
• communicating with prospective buyers and clients regarding the matters stated in their inquiries;
• providing information about residential complexes, sales terms, and mortgage programmes;
• fulfilling contractual obligations;
• complying with the requirements of the legislation of the Republic of Kazakhstan.

3. Categories of Personal Data Processed

Through inquiry forms on the website, the Operator collects the following personal data:

• surname and first name (and patronymic, if provided);
• telephone number;
• email address (if provided);
• any other information voluntarily provided by the data subject in their message.

4. Legal Basis for Processing

Personal data is processed on the basis of:

• the consent of the personal data subject, expressed by completing and submitting the inquiry form on the website (Article 7 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection");
• the necessity to perform a contract to which the data subject is a party, or to conclude a contract at the data subject's initiative;
• requirements of the legislation of the Republic of Kazakhstan.

5. Procedure and Conditions for Processing Personal Data

The Operator processes personal data in compliance with the following principles (Article 5 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection"):

• Lawfulness and good faith — processing is carried out only when a lawful basis exists.
• Purpose limitation — data is collected only to the extent necessary for the stated purposes and is not used for other purposes without the data subject's consent.
• Accuracy — the Operator takes measures to ensure the relevance and accuracy of data.
• Confidentiality — access to personal data is granted only to authorised employees bound by a non-disclosure obligation.
• Security — organisational and technical measures are applied to protect data against unauthorised access, modification, distribution, or destruction.

6. Storage of Personal Data

Personal data is stored on servers located in the Republic of Kazakhstan, in accordance with the requirements of Article 17(2) of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection".

Personal data is retained for the period necessary to achieve the purposes of processing, or until the data subject withdraws consent, but no longer than 5 (five) years unless otherwise required by law.

7. Transfer of Personal Data to Third Parties

The Operator does not transfer personal data to third parties, except in the following cases:

• receipt of the explicit consent of the personal data subject;
• necessity to perform a contract involving the data subject (including transfer to partner banks when processing mortgage applications — solely with the client's consent);
• compliance with the requirements of the legislation of the Republic of Kazakhstan or a court order.

Any transfer of personal data is carried out via secure communication channels in accordance with applicable legal requirements.

8. Rights of the Personal Data Subject

In accordance with Article 24 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection", the personal data subject has the right to:

• obtain information on whether their personal data is being processed;
• receive information about the purposes, methods, and terms of processing of their data;
• request rectification, supplementation, modification, or deletion of their personal data;
• withdraw consent to the processing of personal data;
• appeal against the actions (or inactions) of the Operator to the authorised body or a court.

To exercise their rights, the personal data subject may submit a written request using the contact details set out in Section 10 of this Policy.

9. Personal Data Protection Measures

The Operator takes the necessary legal, organisational, and technical measures to protect personal data against unauthorised or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions, including:

• restricting the circle of persons with access to personal data;
• applying information security tools;
• regular monitoring of compliance with security requirements.

In the event of a personal data security breach, the Operator shall notify the authorised body within one business day of the discovery of the breach (Sub-clause 8, Clause 2, Article 25 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" as amended in 2024).

10. Operator Contact Details

For all matters related to the processing of personal data, you may contact the Operator:

11. Amendments to the Policy

The Operator reserves the right to make amendments to this Policy. The current version of the Policy is always available on the website. Continued use of the website after amendments have been made constitutes acceptance of the updated version of the Policy.