Privacy Policy

1. General provisions

1.1. This Privacy Policy (hereinafter the "Policy") sets out the procedure for the collection, processing, storage and protection of the personal data of users of the website www.alataucity.kz (hereinafter the "Website").

1.2. The operator of personal data is the State Fund "Alatau City Authority", established in accordance with Decree of the President of the Republic of Kazakhstan of 26 September 2025 No. 1015 "On Certain Issues of the Development of the City of Alatau" and operating on the basis of the Constitutional Law of the Republic of Kazakhstan "On the Special Legal Regime of the City of Alatau" (hereinafter the "Operator", "we").

1.3. The Policy has been developed in accordance with the Constitution of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V "On Personal Data and Its Protection" (hereinafter the "Law") and the subordinate legislation adopted for its implementation.

1.4. By using the Website, submitting an enquiry through the forms placed on it, or contacting us using the contact details provided on the Website, you confirm that you have read this Policy and agree to the terms set out herein. If you do not agree with the terms of the Policy, please refrain from providing us with your personal data.

2. Key definitions

This Policy uses the terms defined in Article 1 of the Law:

• personal data - information relating to a data subject who is identified or identifiable on the basis of such information, recorded on an electronic, paper and (or) other tangible medium;
• data subject - a natural person to whom the personal data relates;
• collection of personal data - actions aimed at obtaining personal data;
• processing of personal data - actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalization, blocking and destruction of personal data;
• depersonalization - actions as a result of which it becomes impossible to determine that personal data belongs to a specific data subject.

3. What data we collect

3.1. Data you provide voluntarily. When you complete the Investment Desk feedback form or contact us by email or telephone, we may receive:

• your name;
• your company name and industry (if provided);
• your email address;
• the content of your message and any other information you choose to share.

3.2. Technical data. When you visit the Website, the server infrastructure may automatically record standard technical information: IP address, browser and device type, the date and time of access, and the addresses of the pages requested. This data is used solely to ensure the operability and security of the Website and is not linked to any specific user.

3.3. The Website does not use its own cookies or web-analytics systems (see Section 8). We do not collect biometric or other special categories of personal data, or data that is excessive in relation to the purposes specified in Section 4.

4. Purposes of collection and processing

Personal data is collected and processed for the following purposes:

• reviewing enquiries and applications submitted through the Investment Desk form and providing responses to them;
• providing advisory and organizational support to potential investors and partners of the Alatau City project;
• complying with the requirements of the legislation of the Republic of Kazakhstan applicable to the Operator's activities;
• ensuring the stable operation, security and improvement of the Website.

5. Legal grounds and consent

5.1. The collection and processing of personal data is carried out with the consent of the data subject, given in accordance with Article 8 of the Law. By submitting a form on the Website or sending us an enquiry on your own initiative, you give your consent to the collection and processing of the personal data contained therein for the purposes specified in Section 4 of this Policy.

5.2. Without the consent of the data subject, the collection and processing of personal data is permitted only in the cases expressly provided for by Article 9 of the Law.

5.3. Consent may be withdrawn in the manner established by the Law (see Section 9). Withdrawal of consent has no retroactive effect on processing carried out prior to its withdrawal and does not apply in cases where the processing of data is required by the legislation of the Republic of Kazakhstan.

6. Data storage and retention periods

6.1. In accordance with Article 12 of the Law, personal data is stored in a database located in the territory of the Republic of Kazakhstan.

6.2. Personal data is retained for no longer than the purposes of its collection and processing require, unless a longer retention period is established by the legislation of the Republic of Kazakhstan. Once the purposes of processing have been achieved, or upon withdrawal of consent, the data is subject to destruction or depersonalization in the manner established by the Law.

7. Transfer of data to third parties

7.1. We do not sell personal data and do not transfer it to third parties for marketing purposes.

7.2. The transfer of personal data to third parties is possible only:

• to service providers engaged to ensure the operation of the Website and the handling of enquiries (hosting, IT support), to the extent necessary to provide such services and subject to their compliance with confidentiality;
• to state authorities of the Republic of Kazakhstan, on the grounds and in the manner established by law;
• in other cases, with your consent.

7.3. Cross-border transfer. The transfer of personal data to the territory of foreign states is carried out in accordance with Article 16 of the Law: only to countries that ensure the protection of personal data, and to other countries with the consent of the data subject or in other cases provided for by the Law.

8. Cookies and third-party services

8.1. The Website does not set its own cookies and does not use visitor counters or web-analytics systems.

8.2. At the same time, the Website uses third-party services which, when pages are loaded, may independently process technical data (including the IP address) and use their own cookies in accordance with their privacy policies:

• Google Fonts - loading of web fonts from the servers of Google LLC (Google Privacy Policy);
• Yandex Maps - an interactive map on the pages containing contact information (Yandex Privacy Policy).

8.3. The Website contains links to external resources and social networks (LinkedIn, Instagram, Facebook, TikTok). By following such links, you leave the Website; the processing of data on external resources is governed by their own policies, for the content of which we bear no responsibility.

8.4. You can restrict or block the use of cookies in your browser settings.

9. Rights of the data subject

9.1. In accordance with Article 24 of the Law, you have the right to:

• know that the Operator holds your personal data and obtain information concerning its processing;
• demand the modification and supplementation of your personal data where there are grounds to do so;
• demand the blocking of personal data in the event of a breach of the conditions of its collection and processing;
• demand the destruction of personal data collected and processed in violation of the law;
• withdraw consent to the collection and processing of personal data, except in the cases provided for by the Law;
• give (withdraw) consent to the dissemination of personal data in publicly available sources;
• protect your rights and legitimate interests, including by applying to the authorized body and (or) to the courts.

9.2. To exercise your rights, please send a request to the email address info@alataucity.kz or in writing to the address specified in Section 14. The request will be reviewed within the time limits established by the legislation of the Republic of Kazakhstan.

9.3. The authorized body in the field of personal data protection is the Committee for Information Security of the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan.

10. Data protection measures

10.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unauthorized access, modification, blocking, copying, dissemination and other unlawful actions, including by restricting the range of persons who have access to personal data and by using secure data-transmission channels.

10.2. In the event of a personal data security breach, the Operator notifies the authorized body and the data subjects in the manner and within the time limits established by the legislation of the Republic of Kazakhstan.

11. Data of minors

The Website is intended for a business audience and is not directed at persons who have not reached the age of majority. We do not knowingly collect the personal data of minors; such data may be processed only with the consent of their legal representatives in the manner provided for by the Law.

12. Users from other jurisdictions

12.1. The Website is administered from the territory of the Republic of Kazakhstan, and personal data is processed and stored in the territory of the Republic of Kazakhstan. By providing us with personal data from another jurisdiction, you agree to its processing in the Republic of Kazakhstan in accordance with this Policy.

12.2. If the legislation applicable to you (for example, the EU General Data Protection Regulation - GDPR) grants you additional rights in respect of personal data, including the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing, you may exercise them by contacting us using the contact details specified in Section 14.

13. Amendments to the Policy

The Operator has the right to make changes to this Policy. The new version is published on this page with an indication of the version date and takes effect upon publication, unless otherwise provided by the new version. We recommend that you review the current version of the Policy from time to time.

14. Operator and contacts

For any questions relating to the processing of personal data and this Policy, you may contact us: