Privacy Policy

1. General Provisions

1.1. This Privacy Policy (the "Policy") sets out how WindoW Capital Joint-Stock Company (the "Company") collects, processes, stores, and protects the personal data of users of its services.

1.2. The Company is a professional participant in the securities market of the Republic of Kazakhstan and conducts brokerage activities under licence No. 3.2.256 dated 14 March 2025, issued by the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market (Order No. B-64 dated 14.03.2025).

1.3. The Policy applies to all of the Company's services: the WinIn mobile application for iOS and Android (the "App"), the web platform app.winin.kz, and the website winin.kz (collectively, the "Services").

1.4. By using the Services, you agree to the terms of this Policy. If you do not agree with the Policy, please stop using the Services.

1.5. The Policy has been drawn up in accordance with Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Its Protection", Law of the Republic of Kazakhstan No. 461-II of 2 July 2003 "On the Securities Market", Law of the Republic of Kazakhstan No. 191-IV of 28 August 2009 "On Counteracting the Legalisation (Laundering) of Criminally Obtained Income and the Financing of Terrorism", and other legislation of the Republic of Kazakhstan.

2. Definitions

• Personal data — information relating to an identified or identifiable natural person (personal data subject), recorded on an electronic, paper, or other physical medium.
• Processing of personal data — any operation performed on personal data: collection, recording, organisation, accumulation, storage, alteration, use, transfer, anonymisation, blocking, erasure, and destruction.
• User — a natural person using the Company's Services, including a client of the Company under a brokerage services agreement.
• Account — the set of data about a User required to identify the User and grant access to the Services.

3. What Data We Collect

3.1. Data you provide when registering and opening a brokerage account:

• surname, first name, patronymic;
• individual identification number (IIN);
• date of birth and gender;
• identity document details (type, number, issue date, issuing authority, expiry date);
• registration and residential address;
• mobile phone number and email address;
• bank account details;
• information required to comply with anti-money-laundering legislation (including tax residency and politically exposed person status).

3.2. Data obtained during identification. Remote identification relies on digital identification services (including those of the National Certification Authority of the Republic of Kazakhstan and biometric identification platforms). The Company receives confirmation of your identity and electronic digital signature data; biometric samples are processed by the operators of the relevant state identification systems.

3.3. Transaction data. When you trade financial instruments, submit client orders, or deposit and withdraw funds, the Company records transaction details: type, time, amount, instruments, portfolio composition, and transaction history.

3.4. Technical data collected automatically: device model, operating system version, unique device identifiers, IP address, browser type, language, crash reports, and Service usage data.

3.5. The Company does not collect precise device geolocation data without your separate consent.

4. Purposes of Processing

We use your data to:

• identify you and conclude a brokerage services agreement;
• open and maintain brokerage and personal accounts and execute your client orders;
• operate the App and web platform and display your portfolio, quotes, and transaction history;
• send notifications about your account status, order execution, and corporate events;
• comply with the legislation of the Republic of Kazakhstan, including anti-money-laundering and securities market requirements;
• ensure security: prevent fraud and unauthorised access to your account;
• provide customer and technical support;
• with your consent — inform you about the Company's products, services, and special offers (you can opt out of these communications at any time);
• improve the Services based on anonymised usage statistics.

5. Legal Grounds for Processing

Personal data is processed:

• on the basis of your consent given upon registration in the Services;
• to conclude and perform the brokerage services agreement to which you are a party;
• to fulfil obligations imposed on the Company by the legislation of the Republic of Kazakhstan.

6. Disclosure to Third Parties

6.1. We share your data only to the extent necessary to provide our services, with the following categories of recipients:

• Central Securities Depository JSC, trading venues (KASE, AIX), settlement organisations, and banks — to execute trades and settlements;
• operators of state identification systems and certification authorities — for remote identification and electronic digital signatures;
• technology service providers (hosting, SMS and email delivery) — under contracts obliging them to maintain confidentiality;
• state authorities of the Republic of Kazakhstan — only on the grounds and in the manner established by law.

6.2. The Company does not sell personal data and does not share it with third parties for marketing purposes.

6.3. The use of cloud infrastructure may involve cross-border data transfers. Such transfers are carried out in accordance with Article 16 of the Law of the Republic of Kazakhstan "On Personal Data and Its Protection", provided that the receiving party ensures the protection of personal data.

6.4. Anonymised and aggregated data that cannot identify a User may be used for analytics and statistics.

7. Cookies

The website and web platform use cookies: essential (for the Services to function and for sign-in), functional (remembering your language and settings), and analytical (anonymised visit statistics). You can restrict cookies in your browser settings; essential cookies are required for the Services to work.

8. Retention Periods

8.1. Personal data is stored for the duration of the brokerage services agreement and your use of the Services.

8.2. After the relationship ends, data is retained for the periods established by the legislation of the Republic of Kazakhstan (including at least five years for documents and records required by anti-money-laundering and securities market legislation), after which it is deleted or anonymised.

9. Security

9.1. The Company applies legal, organisational, and technical safeguards: encrypted communication channels (TLS), electronic digital signatures to confirm transactions, role-based employee access, activity logging, and regular security assessments.

9.2. Employee and contractor access to personal data is restricted and granted only to the extent necessary to perform their duties, under confidentiality obligations.

9.3. In the event of an incident affecting your personal data, the Company will notify you and take measures to minimise the consequences.

9.4. To protect your account, keep your login, password, and confirmation codes secret and notify us immediately if you suspect any unauthorised access.

10. Your Rights

10.1. You have the right to:

• receive information about what data is processed and its sources;
• request correction of inaccurate or incomplete data;
• request blocking and erasure of data processed in violation of the law;
• withdraw your consent to processing where processing is not required to perform the agreement or comply with the law;
• opt out of marketing communications;
• delete your account.

10.2. Account deletion. You can delete your account by contacting our support team: send a request to info@winin.kz from the email address you registered with, with the subject line "Account deletion", or call +7 777 555 52 53. The procedure is described at https://winin.kz/en/delete-account. Your account and related data are deleted within 30 calendar days, except for records that must be retained under the legislation of the Republic of Kazakhstan (clause 8.2).

10.3. Requests should be sent to info@winin.kz. We will respond within the period established by law, and no later than 15 calendar days from receipt of your request.

11. Children's Data

The Services are intended for persons aged 18 and over. The Company does not knowingly collect data from minors. If we become aware of such an account, it will be deleted.

12. Changes to the Policy

12.1. The Company may update this Policy. A new revision takes effect once published on winin.kz, unless stated otherwise in the revision itself.

12.2. We will notify you of material changes through the App or by email. Continued use of the Services after changes take effect constitutes acceptance of the new revision.

12.3. The current revision of the Policy is available at https://winin.kz/en/privacy. The revision number and effective date are stated at the top of the document; previous revisions are available on request at info@winin.kz.

13. Contacts

WindoW Capital JSC

23 Kyz Zhibek St., Kok-Tobe microdistrict, Almaty, 050020, Republic of Kazakhstan

Phone: +7 777 555 52 53

Email: info@winin.kz

Licence No. 3.2.256 dated 14.03.2025, issued by the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market