Privacy Policy

1.1. This Privacy Policy (the ‘Policy’) sets out the procedure for the collection, processing, storage and protection of the personal data of users of the internet resource alatau.online (the ‘Site’).

1.2. The operator of personal data is the private company Teren Communications Ltd., BIN 221240900507, legal address: Republic of Kazakhstan, Astana, Yesil District, Mangilik El Avenue, building 41/1 (the ‘Operator’, ‘we’). The Operator acts as a data controller within the meaning of the AIFC Data Protection Regulations.

1.3. The alatau.online Site is not the official website of the city of Alatau, its governing bodies or the State Fund Alatau City Authority. The Site does not accept investment applications; for this purpose, the Site contains links to external resources (see paragraph 8.4).

1.4. This Policy has been developed in accordance with the law of the Astana International Financial Centre (AIFC), including the AIFC Data Protection Regulations (AIFC Regulations No. 10 of 2017), the AIFC Data Protection Rules (AIFC Rules No. 1 of 2018) and other applicable AIFC acts.

1.5. By using the Site or contacting us via the contact details given on the Site, you confirm that you have read this Policy.

2.1. This Policy uses the terms defined in Schedule 1 to the AIFC Data Protection Regulations:

• personal data – any data relating to an identifiable natural person, that is, a living natural person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her biological, physical, biometric, physiological, mental, economic, cultural or social identity;
• data subject – a natural person to whom personal data relates;
• processing of personal data – any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, storage, adaptation or alteration, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of personal data;
• third party – any person other than the data subject, the Operator, a person processing personal data on behalf of the Operator, and a person who, under the direct control of the Operator or such a person, is authorised to process personal data.

2.2. Other terms used in this Policy:

• anonymisation – actions as a result of which it becomes impossible to determine whether personal data belongs to a specific data subject;
• cookies – small text files that are stored in the user’s browser when the Site is visited and that enable the Site to operate and its use to be analysed.

3.1. Data you provide voluntarily. If you contact the Site’s editorial team at the email address given on the Site, we receive your email address, your name (if provided) and the content of your enquiry, as well as any other information that you choose to provide. Please do not include excessive personal data in your enquiries, or data of third parties without their consent.

3.2. Technical data. When you visit the Site, standard technical information is collected automatically: IP address, type of browser and device, operating system, date and time of the visit, addresses of the pages requested, and the source of the referral to the Site (including web analytics tags in links). This data is also collected through a web analytics service (see section 8) and is used to ensure the Site’s operation and security and to analyse traffic.

3.3. We do not collect biometric or other special categories of personal data, or data that is excessive in relation to the purposes set out in section 4.

3.4. Reference and official materials. The Site is informational and reference in nature and publishes publicly available information about the city of Alatau: the texts of regulatory legal acts and other official documents, statistical and other data from open sources, and contact information of state bodies and organisations. Such information is not personal data of Site users, and this Policy does not apply to its publication. Where official materials or contact details contain information about specific officials, it is published to the extent given in the original sources and for reference purposes.

Personal data is collected and processed for the following purposes:

• considering enquiries received by the Site’s editorial team and providing replies to them;
• ensuring the stable operation, security and improvement of the Site, and analysing traffic to it;
• complying with the requirements of applicable law, including AIFC acts.

5.1. The legal basis for the processing of personal data is the consent of the data subject, given in accordance with Articles 9 and 9-1 of the AIFC Data Protection Regulations, as well as the cases provided for by Article 9 of those Regulations in which consent is not required, and other requirements of applicable law.

5.2. Consent to the processing of personal data is given separately and is a condition of sending an enquiry. Without such consent, an enquiry cannot be sent.

5.3. You may withdraw your consent at any time (see section 9). To do so, it is sufficient to send a letter to the address given in section 14. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal and does not prevent processing on other grounds provided for by Article 9 of the AIFC Data Protection Regulations.

6.1. The collection, processing and storage of the personal data of citizens of the Republic of Kazakhstan are carried out using databases located in the territory of the Republic of Kazakhstan.

6.2. Personal data is stored in a form that allows the data subject to be identified for no longer than is required for the purposes of its processing, in accordance with Article 8 of the AIFC Data Protection Regulations, unless a longer retention period is established by applicable law.

6.3. Once the purposes of processing have been achieved, or upon withdrawal of consent or a justified objection to processing, personal data is deleted or anonymised.

7.1. We do not sell personal data and do not disclose it to third parties for marketing purposes.

7.2. Personal data may be disclosed to third parties only:

• to service providers engaged to ensure the operation of the Site (hosting, IT support, web analytics service) – to the extent necessary to provide such services and subject to their observing confidentiality;
• to state bodies and regulators, including AIFC bodies – on the grounds and in the manner established by applicable law;
• in other cases – with your consent.

7.3. Cross-border transfer. The Site uses Google services (the Google Analytics web analytics service and Google Fonts web fonts) and the Yandex Maps service. As a result, technical data is transferred to Google LLC and to the company providing the Yandex Maps service, and may be processed on servers outside the Republic of Kazakhstan. Such transfer is carried out in accordance with Articles 11 and 12 of the AIFC Data Protection Regulations. Data processing by those services is governed by their own privacy policies.

8.1. The Site uses cookies and similar technologies to ensure the Site’s operation and to analyse its use. You may disable cookies in your browser settings; however, some functions of the Site may then become unavailable.

8.2. To analyse traffic, the Site uses the web analytics service Google Analytics (Google LLC), which sets its own cookies and processes technical data (including IP addresses) in accordance with the Google Privacy Policy. The related transfer of data outside the Republic of Kazakhstan is described in paragraph 7.3.

8.3. The Site may also use other third-party services, which, when pages load, independently process technical data and use their own cookies in accordance with their own privacy policies:

• Google Fonts – loading of web fonts from Google LLC servers (Google Privacy Policy);
• Yandex Maps – an interactive map on pages with contact information (Yandex Privacy Policy).

8.4. External links. The Site contains links to third-party resources, including the websites of United Group Alatau and Alatau City Authority with investment application forms, as well as official resources and social networks (LinkedIn, Instagram, Threads, Facebook, TikTok, YouTube, Telegram). These resources are managed by other persons; when you follow the links you leave the Site, and the processing of your data on such resources is governed by their own privacy policies, for the content of which we are not responsible.

8.5. Contacts of third-party organisations. The Site provides, for reference purposes, contact details of state bodies and other organisations (the Akimat, the Maslikhat, Alatau City Authority and others). By using these contacts, you interact directly with the relevant organisations, which act independently as operators of your personal data; this Policy does not apply to such processing.

9.1. In accordance with the AIFC Data Protection Regulations, you have the right to:

• obtain from the Operator written confirmation of whether your personal data is being processed, as well as information about the purposes of processing, the categories of data processed and the recipients to whom it is disclosed;
• receive your personal data in an intelligible form, together with any available information about its source;
• require the rectification, erasure or blocking of personal data if its processing violates the AIFC Data Protection Regulations;
• object at any time to the processing of your personal data on justified grounds relating to your situation;
• be notified before your personal data is first disclosed to a third party or used on its behalf for direct marketing, and object to such disclosure or use;
• withdraw your consent to the processing of personal data at any time;
• lodge a complaint with the AIFC Commissioner of Data Protection and apply to the AIFC Court for compensation for damage.

9.2. To exercise your rights, send a request to the editorial email address info@alatau.online or in writing to the address given in section 14. The request will be considered without undue delay or expense to you.

9.3. Compliance with the AIFC Data Protection Regulations is supervised by the AIFC Commissioner of Data Protection.

10.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unauthorised access, alteration, blocking, copying, dissemination and other unlawful actions, including restricting the circle of persons who have access to personal data and using secure data transmission channels.

10.2. In the event of a personal data breach, the Operator will notify the AIFC Commissioner of Data Protection as soon as possible. If the breach may create a high risk to the security or rights of data subjects, the Operator will also notify them.

The informational materials of the Site are publicly available and intended for a wide audience, including persons who have not reached the age of majority.

At the same time, the Site is not intended to collect the personal data of minors in a targeted way. We do not request such data and ask minors not to send us their personal data without the consent of their legal representatives. The personal data of minors may be processed only with the consent of their legal representatives.

12.1. The Site is administered from the territory of the Republic of Kazakhstan, and personal data is processed and stored in the territory of the Republic of Kazakhstan. By providing us with personal data from another jurisdiction, you agree to its processing in the Republic of Kazakhstan in accordance with this Policy.

12.2. If the legislation applicable to you (for example, the EU General Data Protection Regulation (GDPR)) grants you additional rights in respect of personal data, you may exercise them by contacting us using the contact details given in section 14.

The Operator may amend this Policy. The new version is published on this page, stating the date of the version, and takes effect from the moment of publication unless the new version provides otherwise. We recommend that you periodically review the current version of the Policy.

For all questions relating to the processing of personal data and this Policy, you can contact us:

• Name: Private company Teren Communications Ltd.
• Address: Republic of Kazakhstan, Astana, Yesil District, Mangilik El Avenue, building 41/1.
• Operator’s email: legal@sana.onl
• Site editorial email: info@alatau.online