The Bank ensures the privacy of clients and the protection of personal data, strictly complying with the legislation of the Republic of Kazakhstan.

The collection of a client's personal data is carried out by the Bank with the consent of the client or their representative. The processing and use of the client's personal data (including automated processing) is carried out within the limits and scope provided by the client's consent, as well as in cases stipulated by the legislation of the Republic of Kazakhstan, by the Bank's employees and personnel (consultants, agents working under an agency agreement or a contract for the provision of services for reward) who directly use them for official business purposes. The retention period for personal data is determined by the date on which the purposes of their collection and processing are achieved, unless otherwise provided by the legislation of the Republic of Kazakhstan.

The Bank is not entitled to transfer processed personal data to third-party organizations and/or third parties without the client's consent, except in cases stipulated by the legislation of the Republic of Kazakhstan.

The processing of publicly available personal data obtained from appeals and requests of organizations and individuals, biographical directories, telephone and address books, the media, and in other cases stipulated by the legislation of the Republic of Kazakhstan, may be carried out without the client's consent.

The Bank implements the following measures to ensure the confidentiality of personal data:

1)   signing an obligation on non-disclosure of information constituting a commercial secret, and other information of a confidential nature of the Bank with all employees upon conclusion of an employment contract, and agents, consultants upon conclusion of an assignment contract, a contract of gratuitous provision of services;

2)   workers, employees of structural units do not allow the distribution of personal data without the consent of the client or their legal representative or the presence of another legal basis. Personal data of the client are transferred to third parties only in the presence of their consent or their legal representative or the presence of another legal basis.

3)   conducting by all structural units and workers of the Bank, agents, consultants of measures aimed at the timely discovery and identification of facts of unauthorized access to personal data, namely notification of one's immediate supervisor and the internal control unit about all suspicious situations and violations when working with personal data of the client;

4)   prevention of unauthorized access to personal data and (or) transfer of them to persons not having the right of access to such information by means of restricting access to electronic databases of personal data by a password, to paper variants of personal data – of persons having only official access;

5)   other measures, not provided for in this Procedure, but ensuring constant control over ensuring the level of security of personal data.

In the event that the Bank or other persons with access to clients' personal data violate the regulations governing the receipt, processing, storage, transfer, and protection of clients' personal data, they bear disciplinary, administrative, civil-legal, or criminal liability in accordance with the current legislation of the Republic of Kazakhstan.

In 2025, 2 instances of disclosure of information constituting banking secrecy were registered. The violations were committed by workers/employees of the Bank. In connection with the confirmed facts, and in order to prevent similar cases, the Bank took a number of necessary measures: the head of the respective unit was advised to strengthen control over employees' compliance with the requirements of the Bank's internal documents regulating the procedure for providing information that constitutes banking secrecy.

In 2025, the Compliance Control Department organized a training session on the topic: "Banking Secrecy and the Consequences of Non-Compliance." A total of 741 Bank employees took part in the training.

In 2025, there were no legal proceedings or lawsuits related to the confidentiality of client information.