PaxFinance

Personal Data Processing and Protection Policy

Pax Finance Limited Liability Partnership

BIN 260540020321

License of the National Bank of the Republic of Kazakhstan for dealer activity in the digital asset market - exchange operations with unbacked digital assets No. 0126001O dated 30 June 2026

POLICY

on the processing and protection of personal data

Public version for clients

Version 1.0

APPROVED

by order of the Director of Pax Finance LLP

Beispekov Aslan Galimovich

No. 6 dated 10 July 2026

1. General provisions

1.1. This Policy on the processing and protection of personal data (hereinafter the "Policy") has been developed by Pax Finance LLP, BIN 260540020321 (hereinafter the "Company", the "Personal Data Operator"), on the basis of the License for dealer activity in the digital asset market — exchange operations with unbacked digital assets No. 0126001O dated 30 June 2026, issued by the National Bank of the Republic of Kazakhstan.

1.2. The Policy has been developed in accordance with the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 "On Personal Data and its Protection" (hereinafter the "Personal Data Law"), paragraph 50.5) of the Rules for carrying out the activities of operators for the exchange of unbacked digital assets, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 45 dated 29 April 2026, Section 18 of the Rules for carrying out the activities of the operator for the exchange of unbacked digital assets of the Company and Section 13 of the Company's Information Security and Cybersecurity Policy, and constitutes the detailed procedure for the processing and protection of personal data provided for by paragraph 13.9 of the said Policy.

1.3. This Policy defines the purposes, legal grounds, procedure, periods for the processing and storage of personal data, the rights of personal data subjects and the protective measures applied by the Company.

1.4. Registration of an account, completion of identification procedures and use of the Company's services constitute the Client's familiarization with this Policy and, in the cases provided for by the Personal Data Law, the provision to the Company of consent to the processing of personal data to the extent and on the terms defined by this Policy.

1.5. Nothing in this Policy limits or may be construed as limiting the mandatory rights of the personal data subject established by the Personal Data Law and other legislation of the Republic of Kazakhstan.

2. Terms

  • Personal data - information relating to a personal data subject who is determined or determinable on its basis, recorded on an electronic, paper and (or) other tangible medium.
  • Personal data subject (Client) - a natural person to whom the personal data processed by the Company relates.
  • Personal data operator - the Company, which independently or jointly with other persons organizes and (or) carries out the collection and processing of personal data, and also determines the purposes of collection, processing, the content of the processed personal data, and the actions (operations) performed with it.
  • Processing of personal data - actions involving the collection, processing and protection of personal data aimed at achieving certain purposes, with or without the use of automation tools.
  • Cross-border transfer of personal data - the transfer of personal data to the territory of a foreign state.

3. Purposes of processing personal data

3.1. The Company processes the Client's personal data for the following purposes:

  • identification and verification of the Client within the framework of due diligence (KYC) procedures in accordance with the legislation of the Republic of Kazakhstan on combating the legalization (laundering) of proceeds of crime, the financing of terrorism and the financing of the proliferation of weapons of mass destruction;
  • conclusion and performance of the agreement with the Client, provision of services for the purchase, sale and (or) exchange of unbacked digital assets;
  • assessment of the Client's risk, monitoring of operations, detection and prevention of fraud and other unlawful activity;
  • compliance with the requirements of the legislation of the Republic of Kazakhstan, including the submission of reports and information to authorized state bodies, including the National Bank of the Republic of Kazakhstan and the authorized financial monitoring body;
  • consideration of Clients' requests, complaints and disputes;
  • ensuring information security and cybersecurity, protecting the rights and legitimate interests of the Company, including protection in the event of claims or court demands;
  • informing the Client of changes to the terms of service, tariffs and internal documents of the Company;
  • sending the Client marketing and information messages - solely where the Client has given separate consent, which may be withdrawn at any time without prejudice to the provision of the Company's core services.

3.2. The Company processes personal data to the extent necessary and sufficient to achieve the specified purposes and does not carry out processing of personal data incompatible with those purposes.

4. Legal grounds for processing

4.1. The processing of personal data by the Company is carried out on one or more of the following legal grounds:

  • the consent of the personal data subject;
  • the necessity of performing an agreement to which the personal data subject is a party, or to take measures at the request of the personal data subject prior to the conclusion of an agreement;
  • fulfilment of an obligation directly provided for by the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan "On Combating the Legalization (Laundering) of Proceeds of Crime, the Financing of Terrorism and the Financing of the Proliferation of Weapons of Mass Destruction", and acts of the National Bank of the Republic of Kazakhstan;
  • protection of the life, health or other vital interests of the personal data subject or third parties;
  • other grounds directly provided for by the legislation of the Republic of Kazakhstan.

4.2. Consent

The form and content of the personal data subject's consent to the collection and processing of personal data comply with the requirements of paragraph 4 of Article 7 of the Personal Data Law and are provided by the Company upon registration of an account. If the validity period of the consent is not specified, it is deemed to be valid until the achievement of the processing purposes determined at the time it was given (paragraph 6 of Article 7 of the Personal Data Law).

The personal data subject has the right to withdraw consent to the collection and processing of personal data at any time by notifying the Company. The Company is obliged to cease the processing of personal data within 15 (fifteen) business days from the moment of receipt of such notification, unless the storage or processing of such data is required in accordance with the legislation of the Republic of Kazakhstan, or to provide the subject with a reasoned refusal (paragraph 7 of Article 7 of the Personal Data Law).

5. Categories of personal data processed

5.1. Depending on the type of Client and the service provided, the Company may process the following categories of personal data:

  • surname, first name, patronymic (if any), date of birth, citizenship;
  • individual identification number (IIN), details of the identity document;
  • contact details (phone number, email address, residential address);
  • biometric data - solely within the framework of identification through the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan (IDEC) in the manner established by the legislation of the Republic of Kazakhstan;
  • information about the sources of origin of money and (or) digital assets, financial position - in the cases provided for by the AML/CFT/CPF legislation;
  • information about the operations performed by the Client using the Company's services, including the addresses of the digital asset wallets used by the Client;
  • data on the use of the personal account and mobile application (technical and statistical data, IP address, cookies - in accordance with the Company's separate Cookie Policy);
  • information about public official (PEP) status and other information necessary to assess the Client's risk.

5.2. The Company does not process personal data relating to special categories (regarding racial or ethnic origin, political, religious and other beliefs, state of health, intimate life), except in cases directly provided for by the legislation of the Republic of Kazakhstan or with the express consent of the personal data subject provided for a specific, predetermined purpose.

6. Procedure for collection and sources of personal data

6.1. The Company collects personal data directly from the Client upon registration, completion of identification and in the process of using the Company's services.

6.2. The Company has the right to obtain the Client's personal data from state information systems of the Republic of Kazakhstan through the "e-government" gateway, from the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan, as well as from other sources access to which is provided for by the legislation of the Republic of Kazakhstan, to the extent necessary for the purposes specified in section 3 of this Policy.
6.3. Processing of personal data of Clients who are non-residents of the Republic of Kazakhstan

Identification of Clients who are not residents of the Republic of Kazakhstan is carried out by means of the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan (IDEC) and (or) third-party remote identification services, subject to compliance with the requirements of the legislation of the Republic of Kazakhstan and the Company's internal Rules, in the manner established by paragraph 5.1.2 of the Rules for carrying out the activities of the operator for the exchange of unbacked digital assets of the Company and paragraph 30 of the Rules for carrying out the activities of operators for the exchange of unbacked digital assets, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 45 dated 29 April 2026.

When using third-party remote identification services in respect of non-resident Clients, the Company has the right to obtain and process personal data received from such services, to the extent necessary for the purposes of identification and customer due diligence (KYC), in compliance with the requirements of section 8 of this Policy (cross-border transfer of personal data) if such a service is located outside the Republic of Kazakhstan.

Operations for the purchase and sale of unbacked digital assets with non-resident Clients are carried out in national and (or) foreign currency in accordance with the legislation of the Republic of Kazakhstan, which may require the processing of additional information (including information on tax residence and details of foreign currency accounts) compared to resident Clients.

7. Storage of personal data

7.1. The personal data of Clients is stored in a database physically located on the territory of the Republic of Kazakhstan.

7.2. The storage period of personal data is determined by the achievement of the purposes of its collection and processing, unless another period is established by the legislation of the Republic of Kazakhstan, the agreement with the Client or the Company's internal documents.

7.3. Personal data obtained within the framework of customer due diligence (KYC) procedures and information about the Client's operations are stored for at least 5 (five) years from the day of termination of the business relationship with the Client in accordance with the legislation of the Republic of Kazakhstan on combating the legalization (laundering) of proceeds of crime, the financing of terrorism and the financing of the proliferation of weapons of mass destruction.

7.4. Upon expiry of the established storage period, personal data is subject to destruction or depersonalization in a documented manner, except in cases where the legislation of the Republic of Kazakhstan requires longer storage (including where there are ongoing inspections by authorized bodies, court disputes or other legal grounds).

8. Cross-border transfer and use of external services

8.1. The conditions for the cross-border transfer of personal data are established by Article 16 of the Personal Data Law. The cross-border transfer of personal data to the territory of a foreign state is carried out by the Company provided that such state ensures the protection of the rights of personal data subjects commensurate with the protection provided for by the legislation of the Republic of Kazakhstan, or on the basis of the consent of the personal data subject containing information about the cross-border transfer, or where there is another legal ground directly provided for by the legislation of the Republic of Kazakhstan or an international treaty ratified by the Republic of Kazakhstan.

8.2. The Company has the right to engage third-party service providers (including cloud services, payment providers, remote identification services, cybersecurity service providers), including those located outside the Republic of Kazakhstan, to process individual operations with personal data, subject to conducting a preliminary legal and technical assessment, maintaining the mandatory database on the territory of the Republic of Kazakhstan in accordance with Article 12 of the Personal Data Law and complying with the requirements of this section.

8.3. The transfer of personal data to third parties on the territory of the Republic of Kazakhstan is carried out where there is a legal ground and an agreement concluded with such a person providing for the purposes, the composition of the data transferred, the protective measures, confidentiality, storage periods, the procedure for the return or destruction of data and the procedure for notification of security incidents.

8.4. The Company has the right to disclose the Client's personal data to state bodies of the Republic of Kazakhstan (the National Bank, the authorized financial monitoring body, law enforcement and judicial bodies) upon their lawful request or by virtue of a direct provision of the legislation of the Republic of Kazakhstan without the additional consent of the Client.

9. Personal data protection measures

9.1. The Company applies organizational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, as well as from other unlawful actions, including: access differentiation and logging; cryptographic protection tools; backup; monitoring and response to information security incidents in accordance with the Company's Information Security and Cybersecurity Policy.

9.2. Access to personal data is granted solely to authorized employees of the Company to the extent necessary to perform their job duties.

9.3. In the event of an incident resulting in a breach of the security of personal data, the Company takes measures to eliminate the consequences of the incident in accordance with the Company's Information Security and Cybersecurity Policy. If such an incident is simultaneously a cybersecurity incident, the Company notifies the National Bank of the Republic of Kazakhstan within 24 (twenty-four) hours of the discovery of the incident in the manner established by paragraph 49 of the Rules for carrying out the activities of operators for the exchange of unbacked digital assets, approved by Resolution of the Board of the National Bank of the Republic of Kazakhstan No. 45 dated 29 April 2026. Notification of the authorized body in the field of personal data protection and (or) the affected personal data subjects is carried out in the cases and in the manner provided for by the legislation of the Republic of Kazakhstan on personal data.

10. Rights of the personal data subject

10.1. The Client, as a personal data subject, has the right, in the manner provided for by the Personal Data Law, to apply to the Company to obtain:

  • information concerning the processing of their personal data, including the purposes and legal grounds for processing;
  • clarification, alteration or supplementation of their personal data where it is incomplete, outdated or inaccurate;
  • blocking of their personal data where unlawful processing is detected, for the period of verification;
  • destruction of their personal data where there are no legal grounds for its further processing;
  • withdrawal of consent to the processing of personal data in the part not relating to processing carried out on another legal ground provided for by section 4 of this Policy.

10.2. The right to the destruction of personal data is not absolute. In accordance with paragraphs 3 and 4 of Article 41 of the Digital Code of the Republic of Kazakhstan (enacted on 9 July 2026), a subject's demand for the deletion, anonymization or restriction of the processing of personal data is not subject to fulfilment if the data is necessary for the protection of the life, health and rights of third parties, for the purposes of justice and the consideration of cases of offences, by virtue of a public interest directly established by laws, for state statistics and scientific research subject to anonymization, as well as for the implementation of state functions and the provision of state services, including by virtue of the requirements of the legislation on combating the legalization (laundering) of proceeds of crime, the financing of terrorism and the financing of the proliferation of weapons of mass destruction. In such cases, the Company provides the subject with a reasoned refusal, restricting access to the data and suspending its processing instead of deleting it.

10.3. Deadlines for considering requests

The Company considers requests from the personal data subject within the following periods established by the Personal Data Law:

  • provision of information relating to the subject, or a reasoned refusal to provide it — within 3 (three) business days from the day of receipt of the request (Article 10, Article 25 of the Personal Data Law);
  • alteration, supplementation or destruction of personal data on the basis of supporting documents, blocking of personal data where there is information about a violation of the conditions of its collection and processing - within 1 (one) business day (Article 25 of the Personal Data Law);
  • cessation of the processing of personal data upon withdrawal of consent, or a reasoned refusal - within 15 (fifteen) business days (paragraph 7 of Article 7 of the Personal Data Law).

10.4. A Client who believes that their rights as a personal data subject have been violated has the right to file a complaint with the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan as the authorized body in the field of personal data protection, with the National Bank of the Republic of Kazakhstan (in the part related to the Company's activities as an operator for the exchange of unbacked digital assets), or with a court of the Republic of Kazakhstan.

11. Cookies and similar technologies

11.1. The procedure for the use of cookies and similar technologies on the Company's official website and mobile application is established by the Company's separate Cookie Policy posted on the official website https://paxfinance.kz.

12. Liability

12.1. The Company is liable for violation of the requirements of the legislation of the Republic of Kazakhstan on the protection of personal data in the manner provided for by the legislation of the Republic of Kazakhstan. In accordance with Article 79 of the Code of the Republic of Kazakhstan on Administrative Offences, failure to comply with measures for the protection of personal data resulting in its loss or unlawful collection or processing entails a fine of up to 2,000 (two thousand) monthly calculation indices - for large business entities, up to 1,000 (one thousand) monthly calculation indices - for medium-sized business entities, up to 750 (seven hundred and fifty) monthly calculation indices - for small business entities.

12.2. The Company is not liable for the consequences of the processing of personal data that occur as a result of the Client providing inaccurate, incomplete or outdated information, or as a result of the Client's violation of the procedure for protecting their access identifiers (login, password, two-factor authentication codes).

12.3. The Company is not liable for the actions of third parties who have gained unlawful access to the Client's personal data through no fault of the Company, provided that the Company has taken all reasonable measures of protection provided for by the legislation of the Republic of Kazakhstan.

13. Final provisions

13.1. The Company has the right to unilaterally amend this Policy in connection with changes in the legislation of the Republic of Kazakhstan, the requirements of the National Bank or the Company's internal procedures.

13.2. The current version of the Policy is posted on the Company's official website https://paxfinance.kz and enters into force from the moment of publication, unless another date is specified in the new version. The Client's continued use of the Company's services after the new version enters into force constitutes the Client's agreement to the changes.

13.3. In the event of a conflict between this Policy and Section 18 of the Company's Rules of activity or Section 13 of the Company's Information Security and Cybersecurity Policy, the provisions of the said internal documents apply to the extent they do not contradict the legislation of the Republic of Kazakhstan.

14. Details and contact information of the Company

Full name

Pax Finance Limited Liability Partnership

Short name

Pax Finance LLP

BIN

260540020321

Director

Beispekov Aslan Galimovich

Basis of activity

License No. 0126001O dated 30 June 2026, issued by the National Bank of the Republic of Kazakhstan

Registered address

010000, Republic of Kazakhstan, Astana, Nura district, Kabanbay Batyr Avenue, 47/2, non-residential premises 2

Website

https://paxfinance.kz

Phone

+7 777 992 1113

Email

info@paxfinance.kz

Effective date: [20.07.2026] Version: 1.0