PRIVACY POLICY

The present Data Privacy Policy (hereinafter referred to as the Privacy Policy) applies to data that Bank CenterCredit JSC (TIN 980 640 000 093, Almaty, Al-Farabi Ave. 38) can receive using the website located on the Internet at the domain address: https://green-api.com.kz/en/. The Company processes the data of the Webite users solely within the framework of the requirements of the Legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan dd. May 21, 2013 No. 94-V "On personal data and their protection", as well as international treaties ratified by the Republic of Kazakhstan. The Privacy policy (hereinafter referred to as the Policy) has been developed in accordance with their standards.

The use of the Website by the User means acceptance of the Privacy Policy and the terms of data processing. In case of disagreement with the terms of the Privacy Policy, the User must stop using the Website.

This Policy is aimed for ensuring proper protection of information about Users, including their personal data, from unauthorized access and disclosure.

The Policy, as well as other official documentation of the Website and the current legislation of the Republic of Kazakhstan govern relations associated with the collection, storage, distribution and protection of information about users of the Website. In case of conflicts between this Policy and other official documents of the Website, this Policy shall be applied.

Users should be aware that when clicking on some links posted on the Website, they may be redirected to sites (applications, etc.) of other companies outside the hosting space of Bank CenterCredit JSC (“Facebook”, “google+”, “ VKontakte), where information about Users is collected outside the direct control of Bank CenterCredit JSC and the Website Administration. In this case, the Privacy Policies of the sites and/or applications of third parties will govern the processing of information received from users by these third parties. Bank CenterCredit JSC and the Website Administration shall not be responsible for the information transferred by the User to these third parties.

If the User decides to enter the website using the third-party operator's authentication service, for example: Facebook information, the Company may receive an additional profile, or other information, access to which is allowed by the User in the third-party operator's account to provide to third parties.

1. DEFINITION OF TERMS

1.1. The following terms are used in the Privacy Policy:

1.1.1. "Website Administration" are authorized employees acting on behalf of Bank CenterCredit JSC, who organize and (or) carry out the Processing of confidential data, as well as determine the purposes of processing confidential data, the composition of confidential data to be processed, actions (operations) performed with confidential data.

1.1.2. Confidential data are data left by the User of the website in the feedback forms and applications for connecting services, Cookies, as well as automatically transmitted data during the use of the website, including, but not limited to: IP address, information on the device from which access is carried out, etc.

1.1.3. "Personal data" are the information relating to a certain or determined on their basis the subject of personal data, recorded on electronic, paper and (or) other tangible media.

1.1.4. "Processing of personal data" is any action (operation) or a set of actions (operations) performed using automation tools or without using such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transmission (provision, access), depersonalization, blocking, deletion, destruction of personal data.

1.1.5. “Personal data privacy” is a mandatory requirement for the Operator or other person who has access to personal data to prevent their distribution without the consent of the subject of personal data or other legal grounds.

1.1.6. "User" of the https://green-api.com.kz/en/ website is a person who has access to the Website via the Internet and uses the Website.

1.1.7. "Webite" is a website located on the Internet at the domain address https://green-api.com.kz/en/.

1.1.8. "Cookies" are a small piece of data sent by a web server and stored on the User's computer, which the web client or web browser sends to the web server in an HTTP request each time it tries to open the page of the relative website.

1.1.9. "IP address" is a unique network address of a node in a computer network built using the IP protocol.

2. PRIVACY POLICY SUBJECT

2.1. The Privacy Policy establishes the obligations of the Website Administration to not disclose and ensure the confidentiality of data that the User provides to the Website Administration when working with the website, including when applying for connection.

2.2. Confidential data permitted for Processing under the Privacy Policy are provided by the User by filling out the registration form (an example is provided below), feedback forms and includes the User's name (specified at the User's discretion), telephone, mail (e-mail address) of the Legal Entity. If in the application form the User leaves his personal data instead of the contact details of the legal entity, the Company ensures their protection in accordance with the requirements of the Legislation of the Republic of Kazakhstan on personal data.

2.3. In addition to the registration form, the Website may use various web analytics systems. The Website protects data that are automatically transmitted in the process of viewing ads and when visiting the pages of the Website, including:

• IP address;

• information from Cookies;

• information on the browser (or other program that accesses the display of ads);

• operating system;

• access time, timezone/region;

• Website page address.

2.3.1. Disabling Cookies may result in the inability to access some sections of the Website.

2.3.2. The Website administration may collect statistics in relation to the data specified in clause 2.3. of the Privacy Policy. This information is used to identify and solve technical issues, to counter fraud.

2.3.3. Information is subject to secure storage and non-distribution, except as provided by the Privacy Policy and the legislation of the Republic of Kazakhstan.

2.3.4. The Company and the Website Administration have the right to provide User information to their affiliates (including those operating outside the territory of the Republic of Kazakhstan), as well as to other companies associated with the Company for the purposes specified above. At the same time, affiliates, as well as companies associated with it, are required to adhere to the provisions of this Policy.

2.3.6. The Company does not provide Users' information to companies and individuals not associated with the Company, except for the cases listed below:

• The user has given his consent to this;

• On the grounds and in the manner established by the legislation of the Republic of Kazakhstan, including for the purpose of:

– enforcement of court decisions or enforcement of public authorities legal requirements;

– troubleshooting technical failures or security issues;

– protection of the rights, property or safety of the Company, users of the Company's Services to the extent permitted by current law.

3. PRIVACY POLICY APPLICATION AND AMENDMENTS

3.1. The Policy comes into force for an unlimited period from the moment of its approval by the Company. The Policy in force is invalidated after it is replaced by a new Policy. The Policy is replaced by publishing its new version on the Website.

3.2. The current version of the Policy, which is a public document, is available to any Internet user by clicking on the https://green-api.com.kz/en/privacy-policy link. The Website Administration has the right to make amendments to the Policy that do not contradict the legislation of the Republic of Kazakhstan. Posting a new version of the Policy on the Website after its approval shall be a notification to Website users about the amendments made to the Policy.

4. CONDITIONS AND PURPOSE OF PROCESSING CONFIDENTIAL DATA

4.1. The Website Administration processes the User's confidential data for the following purposes:

- consideration of the User's application for connection to a legal entity/individual entrepreneur of the services provided by Bank CenterCredit JSC, as well as interaction in order to collect the necessary documents and information for concluding a relative agreement with Bank CenterCredit JSC and (or) its partners, consulting on the services provided , informing about current and new products of Bank CenterCredit JSC and its partners.

- technical management of the website, as well as to analyze and improve its work.

5. METHODS AND TERMS OF PROCESSING CONFIDENTIAL DATA

5.1. Processing User's data is carried out without time limit in any legal way, including in personal data information systems using automation tools or without using such tools.

5.2. The User consents to processing confidential data for an unlimited period.

5.3. The User's data can be transferred to the authorized state authorities of the Republic of Kazakhstan only on the grounds and in the manner established by the legislation of the Republic of Kazakhstan.

5.4. The Website administration is obliged to take the necessary organizational and technical measures to ensure the confidentiality, integrity, safety and availability of confidential data of Users, as well as comply with other requirements for data processing established by the legislation of the Republic of Kazakhstan.

5.5. In case of loss or disclosure of confidential data, the Website Administration informs the User about the loss or disclosure of his data.

5.6. The Website administration, together with the User, take all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the User's confidential data.

6. OBLIGATIONS OF THE PARTIES

6.1. The User is obliged to:

6.1.1. Provide up-to-date data requested by the Website at the time of its use.

6.1.2. Update, supplement the provided data in case of changes in this information.

6.1.3. Preliminarily obtain all necessary consents from third parties in case of providing their data to the Website Administration.

6.2. The Website administration is obliged to:

6.2.1. Use the received confidential data solely for the purposes specified in Section 4 of the Privacy Policy.

6.2.2. Ensure that confidential information is kept secret, not disclose it without the prior written permission of the User, and also not sell, exchange, publish, or disclose confidential data in other possible ways, except as provided for by the Privacy Policy, concluded agreements with clients, and the legislation of the Republic of Kazakhstan.

6.2.3. Take precautions to protect the privacy of the User's data in accordance with the procedure usually used to protect this kind of information in the existing business turnover, and in accordance with the requirements of the legislation of the Republic of Kazakhstan.

7. RESPONSIBILITIY OF THE PARTIES

7.1. The Website administration, which has not fulfilled its obligations, is liable for losses incurred by the User in connection with the unlawful use of confidential data, in accordance with the legislation of the Republic of Kazakhstan, with the exception of cases provided for in clause 7.2.

7.2. In case of loss or disclosure of Confidential Information, the Website Administration is not responsible if this confidential information:

7.2.1. Has become public domain before its loss or disclosure.

7.2.2. Was received from a third party until it has been received by the Website Administration.

7.2.3. Has been disclosed with the consent of the User.

7.3. The User reimburses Bank CenterCredit JSC in full for damages in the event that third parties, including state bodies, file claims against Bank CenterCredit JSC regarding the Processing of Personal Data transferred by the User to the Website Administration without the consent of the subject of personal data, Processing of inaccurate/distorted/outdated Personal data due to the fault of the User.

8. SETTLEMENT OF DISPUTES

8.1. Before filling a claim with a court on disputes arising from the relationship between the User of the https://green-api.com.kz/en/ website and the Website Administration, it is mandatory to file a pre-arbitration notice (a written proposal for a voluntary settlement of the dispute).

8.2. The recipient of the pre-arbitration notice, within 30 (thirty) calendar days from the date of receipt of the pre-arbitration notice, notifies the claimant in writing of the results of the consideration of the pre-arbitration notice.

8.3. If an agreement is not reached, the dispute will be referred to the judicial authority in accordance with the current legislation of the Republic of Kazakhstan.

8.4. The current legislation of the Republic of Kazakhstan applies to this Privacy Policy and the relationship between the User and the Website Administration.

9. SUPPLEMENTARY PROVISIONS

9.1. Processing personal data is carried out from the moment of conclusion of agreements between Bank CenterCredit JSC and customers and is governed by their termsand conditions.

9.2. The User/subject of personal data may at any time withdraw consent to the Processing of Personal Data by sending a written application to Bank CenterCredit JSC at the address: Almaty, Al-Farabi Ave 38. In this case, the Website Administration may continue to process Personal Data without the consent of the User/subject of Personal Data in cases established by the legislation of the Republic of Kazakhstan.

9.3. The User/subject of personal data has the right to exercise their rights under Chapter 4 of the Law of the Republic of Kazakhstan dd. May 21, 2013 No. 94-V “On Personal Data and their Protection”, including to receive information related to the Processing of personal data, to request clarification or blocking, or destruction of Personal Data in cases provided for by law, take measures to protect their rights. Interaction is carried out in writing at the address specified in clause 9.2. of the Privacy Policy.

9.4. This Privacy Policy and the relationship between the User and the Website Administration arising in connection with the application of the Privacy Policy shall be subject to the law of the Republic of Kazakhstan.

9.5. The operator has the right to make amendments to this Privacy Policy without the consent of the User.

9.6. The new Privacy Policy comes into force from the moment it is posted on thehttps://green-api.com.kz/en/ website unless otherwise provided by the new version of the Privacy Policy.

9.7. The User undertakes to independently monitor amendments to the Privacy Policy by reviewing the current version.

9.8. All suggestions or questions about this Privacy Policy should be reported by sending a message using the Website.

9.9. The Privacy Policy is posted on the page at https://green-api.com.kz/en/privacy-policy

Date of publication: 22.09.2022