PERSONAL DATA PRIVACY POLICY

This Privacy Policy (the “Policy”) has been prepared in accordance with Law No. 94-V of the Republic of Kazakhstan dated May 21, 2013, “On Personal Data and Its Protection.” It applies to all information that Otis LLP (OTIS Security trademark, the “Company”), which owns the website at otis.kz, may obtain about a User while the User is using the Company website.

1. Definitions

The following terms are used in this Policy:

Website Administration (otis.kz) means the authorized employees who manage the website on behalf of the Company, organize and carry out personal data processing, and determine the purposes of processing and the data to be processed.

Personal data means any information relating to an identified or identifiable individual, directly or indirectly (the personal data subject).

Personal data processing means any action or set of actions performed with or without automated tools, including collection, recording, organization, accumulation, storage, clarification (updating or alteration), retrieval, use, transfer, anonymization, blocking, deletion and destruction of data.

Personal data confidentiality means the Website Administration's obligation not to disclose personal data without the data subject's consent or another lawful basis.

Website User (User) means a person who accesses the website through the internet and uses the Company website.

Cookies are small pieces of data sent by a web server and stored on the User's device.

IP address means the unique network address of a node in a computer network.

2. General provisions

2.1. By using the Company website, the User accepts this Policy and the terms governing the processing of the User's personal data.

2.2. If the User does not accept this Policy, the User must stop using the website.

2.3. This Policy applies to otis.kz and Company-owned subdomains, including cctv.otis.kz. The Company does not control and is not responsible for third-party websites that the User may access through links on the website.

2.4. The Website Administration does not verify the accuracy of personal data supplied by the User and assumes that the User provides accurate information.

3. Scope of the Privacy Policy

3.1. This Policy establishes the Website Administration's obligations to keep confidential and protect the personal data that the User provides through contact and request forms on the website.

3.2. Personal data permitted for processing:

— the User's name;

— contact telephone number;

— email address, if provided;

— property details voluntarily provided by the User, including property type, number of properties, city and service of interest.

3.3. Data collected automatically when the website is visited (technical data):

— IP address and information about the browser or other software used to access the website;

— information from cookies;

— access time and the address of the requested page;

— referrer, meaning the address of the previous page;

— advertising campaign parameters associated with the visit (UTM tags).

3.4. The Company does not collect special categories of personal data or data relating to minors. Disabling cookies may prevent some website features from working fully.

4. Purposes of collecting personal information

The Website Administration uses the User's personal data for the following purposes:

4.1. Processing a request: identifying the User, providing advice on security services, agreeing a time for a free property survey and preparing a cost estimate.

4.2. Communication: contacting the User, sending notifications, confirming an engineer's visit and processing questions and requests.

4.3. Entering into and performing a contract: preparing a security services agreement and carrying out related communications.

4.4. Improving service quality: providing customer and technical support and analyzing service quality.

4.5. Information: sending information about Company services, rates and special offers only where the User has given separate, voluntary consent.

4.6. Advertising analytics: evaluating the effectiveness of advertising channels using anonymized data.

5. Methods and periods of personal data processing

5.1. Personal data is processed by any lawful method, including within personal data information systems, with or without automated tools.

5.2. Personal data is processed for as long as necessary to achieve the processing purposes. If a contract is entered into, data is processed for the term of the contract and for the document-retention period required by the laws of the Republic of Kazakhstan.

5.3. Transfers to third parties. The Website Administration may transfer data to third parties solely to process a request and perform a contract, including telecommunications operators and notification services, information-system maintenance providers, and Company branches and subsidiaries. Personal data is not sold, exchanged or published.

5.4. Public authorities. Personal data may be transferred to authorized public authorities of the Republic of Kazakhstan only on the grounds and in the manner prescribed by Kazakhstan law.

5.5. Withdrawal of consent. The User may withdraw consent to personal data processing at any time by sending notice to info@otis.kz. The Company will stop processing and destroy the data unless continued retention is required by Kazakhstan law.

5.6. The Administration takes the organizational and technical measures necessary to protect personal data against unlawful access, destruction, alteration, blocking, copying and disclosure.

6. Obligations of the parties

6.1. The User must:

— provide accurate information required to process the request and communicate with the User;

— update and supplement the information provided if it changes.

6.2. The Administration must:

— use the information received solely for the purposes set out in Section 4 of this Policy;

— keep confidential information secure and not disclose it without the User's prior consent, except as provided in Section 5;

— block personal data relating to the relevant User from the time the User or an authorized authority makes a request and for the duration of an investigation if inaccurate data or unlawful actions are identified.

7. Liability of the parties

7.1. If the Website Administration fails to meet its obligations, it is liable for losses incurred by the User through unlawful use of personal data in accordance with the laws of the Republic of Kazakhstan.

7.2. If confidential information is lost or disclosed, the Administration is not liable if the information:

— became public before it was lost or disclosed;

— was received from a third party before it was received by the Website Administration;

— was disclosed with the User's consent.

8. Dispute resolution

8.1. Before filing a court claim concerning a dispute between the User and the Website Administration, the claimant must submit a pre-trial claim, meaning a written proposal for voluntary settlement.

8.2. The recipient of the claim will notify the claimant in writing of the outcome within 30 (thirty) calendar days after receiving it.

8.3. If no agreement is reached, the dispute will be referred to the courts in accordance with the laws of the Republic of Kazakhstan.

9. Additional provisions

9.1. The Website Administration may amend this Policy without the User's consent to keep it aligned with current legal requirements.

9.2. A new version of the Policy takes effect when published on otis.kz unless the new version states otherwise.

9.3. Questions and proposals concerning this Policy should be sent to info@otis.kz or through the contact details in the Contacts section of the Company website.