Privacy policy

PRIVACY POLICY AND PERSONAL DATA PROCESSING POLICY

QARA STUDIOS LLP

Effective Date: 28 October 2026

1. GENERAL PROVISIONS

1.1. This Privacy Policy and Personal Data Processing Policy (hereinafter referred to as the “Policy”) sets out the procedures for the collection, processing, storage, use, transfer and protection of personal data of individuals who visit and use the website of QARA STUDIOS LLP (hereinafter referred to as the “Website”).

1.2. The owner and operator of personal data is QARA STUDIOS Limited Liability Partnership, Business Identification Number (BIN) 200740008389 (hereinafter referred to as the “Company”).

1.3. This Policy has been developed in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V “On Personal Data and Their Protection” and other regulatory legal acts of the Republic of Kazakhstan governing the collection, processing and protection of personal data.

1.4. This Policy applies to personal data obtained by the Company through the Website, including data provided when completing contact forms or submitting enquiries, requests and proposals for cooperation.

1.5. The Company collects and processes personal data solely to the extent necessary to achieve specific, predetermined and lawful purposes.

1.6. This Policy is publicly available on the Website and accessible to an unlimited number of persons.

1.7. Users provide their personal data through the Website forms voluntarily, except where the provision of such data is required by the legislation of the Republic of Kazakhstan.

2. PERSONAL DATA SUBJECT TO COLLECTION AND PROCESSING

2.1. Depending on the Website features used by the user, the Company may collect and process the following personal data:

• Surname, first name and patronymic (if applicable);
• Contact telephone number;
• Email address;
• Name of the organisation and the user's position, if provided;
• Contents of the enquiry, request, proposal or message;
• Other information voluntarily provided by the user and necessary to review their enquiry.

2.2. When users visit the Website, technical information necessary for its operation and information security may also be processed, including IP address, browser type, device information, date and time of access, technical logs and cookies, where such technologies are used on the Website.

2.3. The Company does not require users to provide their Individual Identification Number (IIN), copies of identity documents, biometric data, banking details or other information unnecessary for reviewing an enquiry through standard contact forms.

2.4. Users independently determine the content of their enquiries. The Company recommends that users refrain from including confidential or other information that is not directly relevant to the subject of their enquiry.

2.5. The Company does not intentionally collect personal data in excess of what is necessary for the stated processing purposes.

3. PURPOSES OF PERSONAL DATA COLLECTION AND PROCESSING

3.1. Users' personal data is collected and processed by the Company for the following purposes:

3.1.1. Receiving, registering, reviewing and processing enquiries, requests and messages submitted through the Website.

3.1.2. Establishing and maintaining communication with users, including providing responses, clarifications and information relevant to their enquiries.

3.1.3. Reviewing proposals for commercial, creative and other forms of cooperation with the Company.

3.1.4. Conducting correspondence and communicating with users regarding matters specified in their enquiries.

3.1.5. Ensuring the proper functioning of the Website, providing technical support and maintaining information security.

3.1.6. Fulfilling the Company's obligations under the legislation of the Republic of Kazakhstan.

3.2. The Company does not use personal data obtained through contact forms to send advertising or marketing communications without obtaining the user's separate consent, where such consent is required by law.

3.3. Personal data may be used for purposes not specified in this Policy or covered by the original consent only where additional user consent or another lawful basis exists.

4. CONSENT TO THE COLLECTION AND PROCESSING OF PERSONAL DATA

4.1. Users' personal data is collected and processed with their consent, except in cases expressly provided for by the legislation of the Republic of Kazakhstan.

4.2. By completing and submitting a contact form, the user confirms their consent to the collection and processing of personal data by independently ticking the relevant checkbox on the Website.

4.3. By ticking the checkbox, the user confirms that they:

• Have read this Policy;
• Understand the purposes and conditions of personal data processing;
• Consent to the collection and processing by the Company of the personal data provided in the form for the purpose of reviewing their enquiry and providing a response;
• Have been informed of their right to withdraw their consent in accordance with the procedure established by this Policy.

4.4. The user's consent applies exclusively to the personal data and processing purposes specified in this Policy and the relevant consent.

4.5. The Company may record the fact that consent has been given, including the date and time of consent, information about the submitted form, the version of the consent text and other technical information necessary to demonstrate the lawfulness of personal data processing.

4.6. The absence of the user's consent may prevent the submission of an enquiry through the relevant Website form where the processing of such enquiry requires the collection of personal data.

5. PROCEDURES FOR PROCESSING AND STORING PERSONAL DATA

5.1. Personal data may be processed by automated means, without the use of automation tools, or through a combination of both methods.

5.2. Personal data processing may include collection, recording, systematisation, accumulation, storage, updating, use, transfer where permitted by law, blocking, anonymisation, destruction and deletion.

5.3. The Company ensures that personal data is accumulated and stored in databases and/or digital resources located within the territory of the Republic of Kazakhstan, in accordance with the requirements of the legislation of the Republic of Kazakhstan.

5.4. Personal data provided by users through contact forms is processed for the period necessary to review the enquiry and complete the related correspondence, but for no longer than twelve (12) months from the date of the last interaction relating to the relevant enquiry, unless a longer retention period is required by the legislation of the Republic of Kazakhstan or applicable contractual obligations.

5.5. The user's consent remains valid for the period necessary to achieve the personal data processing purposes specified in this Policy.

5.6. Once the processing purposes have been achieved or other grounds provided for by law have arisen, personal data shall be destroyed, deleted or anonymised, unless its further storage is required under the legislation of the Republic of Kazakhstan.

6. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

6.1. The Company maintains the confidentiality of users' personal data and does not unlawfully disclose, distribute or provide such data to third parties.

6.2. Personal data may be transferred to third parties with the user's consent or in other cases provided for by the legislation of the Republic of Kazakhstan.

6.3. To ensure the operation of the Website and the processing of enquiries, the Company may engage hosting providers, technical support providers, information system maintenance providers and email service providers, where granting them access to personal data is necessary for the performance of their respective functions.

6.4. When engaging third parties, the Company takes the necessary measures to ensure the confidentiality of personal data, restrict its use to the specified purposes and ensure compliance with the requirements of the legislation of the Republic of Kazakhstan.

6.5. The Company may provide personal data to government authorities and other authorised persons in the cases, manner and scope prescribed by the legislation of the Republic of Kazakhstan.

6.6. The Company does not sell users' personal data to third parties or make it publicly available solely on the basis of consent to the review of an enquiry.

7. CROSS-BORDER TRANSFER OF PERSONAL DATA

7.1. Whether personal data is transferred across national borders depends on the infrastructure, information systems and third-party services used by the Company.

7.2. Cross-border transfer status in connection with the processing of enquiries submitted through the Website: such transfers are carried out with the relevant countries, recipients and purposes specified.

7.3. Where personal data is transferred across national borders, the Company ensures compliance with the requirements of Article 16 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, including obtaining the data subject's consent where required.

7.4. Cross-border transfers do not release the Company from its obligation to comply with the applicable requirements of the legislation of the Republic of Kazakhstan regarding the accumulation, storage and protection of personal data.

8. USE OF COOKIES

8.1. The Website may use cookies — small data files stored on the user's device and necessary for certain Website functions.

8.2. Depending on the technologies actually implemented, cookies may be used to ensure the proper functioning of the Website, retain technical settings and analyse the performance of the web resource.

8.3. Users may restrict or disable the use of cookies through their browser settings. Disabling certain cookies may affect the functionality of certain Website features.

8.4. If the Website uses third-party analytics, advertising or other services that collect personal data, the Company ensures that users are informed of their use and that any necessary consent is obtained in accordance with the legislation of the Republic of Kazakhstan.

9. USERS' RIGHTS

9.1. Users have the right to:

9.1.1. Obtain information about whether the Company holds their personal data, as well as the purposes, sources, methods and periods of its processing and storage.

9.1.2. Request the amendment or supplementation of their personal data where there are grounds confirming the need for such changes.

9.1.3. Request the blocking of their personal data where there is information indicating a violation of the conditions for its collection or processing.

9.1.4. Request the destruction or deletion of their personal data in cases provided for by the legislation of the Republic of Kazakhstan.

9.1.5. Withdraw previously given consent to the collection and processing of their personal data, except in cases provided for by the legislation of the Republic of Kazakhstan.

9.1.6. Seek protection of their rights and legitimate interests from authorised government authorities and the courts in accordance with the legislation of the Republic of Kazakhstan.

9.2. To exercise these rights, users may submit a relevant request to the Company using the contact details provided in Section 13 of this Policy.

9.3. The Company reviews users' requests within the time limits established by the legislation of the Republic of Kazakhstan. Information concerning a user's personal data or a reasoned refusal to provide such information is generally provided within three (3) business days of receipt of the relevant request, unless otherwise stipulated by law.

10. WITHDRAWAL OF CONSENT TO PERSONAL DATA PROCESSING

10.1. Users may withdraw their consent to the collection and processing of their personal data by sending a relevant notice to the Company's email address specified in Section 13 of this Policy.

10.2. The notice must contain information sufficient to establish the applicant's identity and identify the previously submitted enquiry to which the personal data relates.

10.3. Within fifteen (15) business days of receiving the notice of withdrawal of consent, the Company shall cease processing the relevant personal data, unless its further processing or storage is required under the legislation of the Republic of Kazakhstan, or provide a reasoned refusal.

10.4. Withdrawal of consent does not affect the lawfulness of personal data processing carried out before the withdrawal notice was received and does not release the Company from fulfilling obligations expressly imposed by the legislation of the Republic of Kazakhstan.

11. PERSONAL DATA PROTECTION

11.1. The Company takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, alteration, blocking, disclosure, destruction, deletion and other unlawful actions.

11.2. Access to personal data is granted only to employees and other authorised persons who require such access to perform their respective duties.

11.3. Persons granted access to personal data are required to comply with the established confidentiality and information security requirements.

11.4. If personal data security breaches are identified, the Company takes measures to remedy them and fulfils its obligations to notify the authorised authorities and other persons in the cases and manner prescribed by the legislation of the Republic of Kazakhstan.

12. AMENDMENTS TO THE POLICY AND FINAL PROVISIONS

12.1. The Company reserves the right to amend and supplement this Policy in connection with changes in the legislation of the Republic of Kazakhstan, personal data processing procedures or the functionality of the Website.

12.2. The current version of the Policy is published on the Website and made publicly available, together with its effective date.

12.3. If amendments introduce new purposes or conditions for personal data processing that require additional user consent, the Company shall obtain such consent in accordance with the legislation of the Republic of Kazakhstan.

12.4. Any matters not governed by this Policy shall be subject to the legislation of the Republic of Kazakhstan.

13. COMPANY DETAILS AND CONTACT INFORMATION

Owner and operator of personal data:

QARA STUDIOS Limited Liability Partnership

BIN: 200740008389

Registered address: Office 707, 7th Floor, Block 1 “B”, Nurly Tau Multifunctional Complex, 13 Al-Farabi Avenue, Almaty 050059, Kazakhstan.

Email for enquiries regarding personal data: info@qarastudios.com

Website: qarastudios.com

All enquiries concerning the collection, processing, storage, amendment, blocking, destruction and deletion of personal data, as well as the withdrawal of consent, may be submitted using the contact details provided above.