PRIVACY POLICY

This Privacy Policy describes how Apex Management GP Ltd. (“we”, “us”, the “Company”) collects, uses, stores, discloses and protects personal data when the Apex Management GP Ltd. corporate website (the “Website”) is used, when enquiries are submitted through Website forms and during subsequent business correspondence.

Apex Management GP Ltd. is a Private Company registered in the Astana International Financial Centre (AIFC), BIN 230940900036. The Company is regulated by the Astana Financial Services Authority (AFSA), Licence No. AFSA-A-LA-2023-0009.

For the purposes of applicable law, Apex Management GP Ltd. acts as the owner/operator and/or Data Controller of personal data to the extent that the Company determines the purposes and means of processing.

Contact for personal data matters: info@apexmanagement.kz.

Personal data processing is carried out taking into account:

• AIFC Data Protection Regulations 2017, as amended from time to time;
• AIFC Data Protection Rules 2018, as amended from time to time;
• Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 “On Personal Data and Their Protection”, to the extent applicable to the relevant processing;
• other applicable AIFC and Republic of Kazakhstan acts relevant to a particular processing operation.

Where several legal regimes apply to the same operation, the Company organises processing with regard to each of them and ensures an appropriate level of protection for the data subject.

3.1. Data provided directly by the user

When a contact form or another Website form is completed, the following data may be processed:

• first name and surname;
• company name;
• job title;
• business e-mail address;
• purpose of the enquiry;
• country;
• message text;
• confirmation of consent to personal data processing;
• other information voluntarily included by the user in the message.

Please do not submit through the general form special categories or confidential personal data, health information, biometric data, identity document details, bank details, passwords or other highly sensitive information unless the Company has expressly requested such information through a secure channel.

3.2. Technical data

When the Website is visited, the technical infrastructure may automatically receive a limited set of network and technical data, such as:

• IP address;
• date and time of the request;
• browser, device and operating system information;
• requested URLs and technical security logs;
• cookies and similar identifiers to the extent described in the Cookie Policy.

Optional analytics identifiers are activated after the user has provided consent through the consent management mechanism used on the Website.

We may process personal data for the following purposes:

• receiving, registering and responding to enquiries;
• organising negotiations with potential investors, partners, project owners, suppliers and other counterparties;
• preliminary assessment of investment and partnership opportunities;
• conducting subsequent due diligence, KYC, AML/CTF and other regulatory procedures where they become applicable and the user is transferred into the relevant secure process;
• compliance with legislation, AIFC Acts, requests from AFSA, courts, law enforcement or other competent authorities;
• protection of information systems, prevention of misuse and investigation of incidents;
• business correspondence and corporate record-keeping;
• improving the Website using permitted aggregated or anonymised data;
• Website usage analytics, within the applicable legal basis and consent settings.

Depending on the circumstances, processing may be based on:

• consent of the data subject expressed in a manner that enables the fact of consent to be evidenced;
• compliance with the Company’s legal and regulatory obligations;
• establishment, exercise or defence of legal claims;
• other grounds expressly permitted by the applicable law of the AIFC or the Republic of Kazakhstan.

Where processing is based on consent, the data subject may withdraw consent within the scope and in the manner permitted by applicable law. Withdrawal of consent does not render unlawful processing carried out before withdrawal and does not affect data whose retention continues on the basis of law or an outstanding obligation.

Apex Management GP Ltd. does not sell personal data and does not provide it to third parties for independent advertising data trading.

To the extent necessary, data may be accessible to:

• hosting, CMS, forms, e-mail, information security and other IT infrastructure providers acting on the Company’s instructions;
• professional advisers, auditors, lawyers and compliance providers where there is a lawful purpose and an obligation of confidentiality;
• group companies or project entities where objectively necessary to consider an enquiry and permitted by applicable law;
• AFSA, AIFC Bodies, courts, law enforcement, tax and other competent authorities where disclosure is made on the basis of law or a proper request;
• other recipients with the data subject’s consent or on another lawful basis.

Use of international cloud, communications or technical infrastructure may result in data being transferred outside the jurisdiction of the AIFC and/or the Republic of Kazakhstan.

Such transfers are carried out where there is an applicable legal basis and appropriate safeguards. The Company applies the AIFC Data Protection Regulations to transfers of data to recipients outside the AIFC, including rules applicable to jurisdictions with an insufficient level of protection, and also applies the relevant provisions of the legislation of the Republic of Kazakhstan on cross-border transfers of personal data.

For the relevant transfers, before processing begins the Company obtains separate consent or permission, submits a regulatory notification and puts contractual safeguards in place, depending on the applicable legal regime.

For processing subject to the data localisation rules of the Republic of Kazakhstan, the Company ensures the accumulation and storage of personal data in a database and/or digital object located in the Republic of Kazakhstan to the applicable extent.

The location of the primary enquiries database, e-mail providers and backups is recorded in the internal register of processing operations and taken into account in the Website’s technical architecture.

Personal data is retained no longer than necessary for the purposes for which it is collected and processed. Longer retention applies where provided for by law, AIFC Acts, AFSA rules, contract, protection of the Company’s rights or record-retention rules.

Once the purpose has been achieved, data is deleted, destroyed, anonymised or archived where there is a lawful basis for doing so.

Technical retention of enquiries within the form platform is minimised; business correspondence and records that become part of a regulated client, investment, compliance or contractual file are retained in accordance with the retention periods established for them.

The Company applies reasonable technical and organisational safeguards proportionate to the nature of the data and the risks of processing, including access controls, account management, protection of communications, backups, logging and incident management.

When engaging a Data Processor or other processor, the Company selects a provider capable of maintaining appropriate safeguards and structures the relationship to the extent consistent with applicable law.

Depending on the applicable regime, a data subject may have the right to:

• obtain information about the fact and purposes of processing;
• obtain access to their personal data;
• request correction of inaccurate or incomplete data;
• request blocking, deletion or destruction of data where grounds provided by law exist;
• object to certain processing;
• withdraw previously provided consent where withdrawal is permitted by law;
• obtain information on recipients and transfers of data to the extent provided by applicable law;
• lodge a complaint with a competent authority, including the AIFC Commissioner of Data Protection where the AIFC regime applies;
• use other remedies provided by applicable law.

A request may be submitted to info@apexmanagement.kz. To protect personal data, the Company may request reasonable proof of the applicant’s identity before acting on the request.

The contact form does not constitute consent to receive advertising or marketing communications. To use contact details for direct marketing, the Company requests separate consent and provides an option to opt out subsequently.

The ordinary Website contact form is not intended to make decisions that have legal or similarly significant effects on the user solely by automated means.

The Website is intended for a business and professional audience and is not designed for the targeted collection of minors’ data. If the Company determines that a minor’s data has been provided without an appropriate basis, reasonable measures will be taken to delete it or otherwise process it lawfully.

The Website may contain links to AFSA, AIFC, fund, project, partner and other external resources. After a user moves to an external resource, data processing is governed by the policy of the relevant operator.

The Company updates this Policy when the Website, technical architecture or legal regulation changes. The date of the current version is stated on the page. Material changes associated with a new user consent are introduced after such consent has been obtained.

Apex Management GP Ltd.

BIN: 230940900036

E-mail: info@apexmanagement.kz

AFSA Licence: AFSA-A-LA-2023-0009

AIFC Data Protection Framework

AFSA Public Register

Law of the Republic of Kazakhstan “On Personal Data and Their Protection”