Privacy Policy of EvoPay LLP

Effective Date: January 1, 2026

Last Updated: January 23, 2026

1. Introduction

EvoPay LLP ("we", "us", "our", or "EvoPay") is committed to protecting the privacy and security of your personal information. This Privacy Policy ("Policy") explains in detail how we collect, use, disclose, store, and protect your personal data when you use our website, mobile application, payment gateway, escrow services, and any related features (collectively, the "Services").

This Policy is governed by the laws of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" and other applicable regulations.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, you must not use our Services.

2. Data Controller

The data controller responsible for your personal information is:

• EvoPay LLP (BIN: 240440034473)
• Address: Kazakhstan, Almaty, Auezov District, Microdistrict 6, Building 58, Apt. 23

3. Information We Collect

We collect several categories of information to provide, secure, and improve our Services.

3.1. Information You Provide Directly

Account Information: Name, email address, phone number, date of birth, username, password, profile photo.

Identity Verification (KYC) Data: Copy of government-issued ID (passport, national ID), selfie for facial verification, proof of address (utility bill, bank statement), Tax Identification Number (if applicable).

Financial Information: Bank account details, payment card information (processed by certified payment processors), transaction history, wallet balances.

Transaction Details: Information related to escrow agreements, including descriptions of goods/services, communication with other users, dispute evidence, and settlement terms.

Communication Records: Contents of your communications with our support team, feedback, survey responses, and recorded calls (where applicable and with consent).

3.2. Information Collected Automatically

Device & Technical Data: IP address, device type and model, operating system, browser type, unique device identifiers, mobile network information.

Usage Data: Pages visited, features used, time spent on the platform, clickstream data, search queries, date and time stamps.

Location Data: Approximate location derived from your IP address, and precise location (if you grant permission in our mobile app for fraud prevention).

Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies. For more details, please see our separate Cookie Policy.

3.3. Information from Third Parties

Credit and Fraud Prevention Agencies: We may receive information to verify your identity and assess fraud risk.

Financial Institutions: Banks and payment processors may share limited information to confirm payment status.

Public Sources: We may collect data from publicly available sources for enhanced due diligence (e.g., sanctions lists).

Other Users: Other users may provide your information during a transaction or dispute (e.g., your email in a transaction memo).

4. Purposes and Legal Bases for Processing

We process your personal data based on the following legal grounds under Kazakhstani law:

1. Service Provision & Contract Fulfillment — Account, Financial, Transaction, Communication

   Legal basis: Necessary for the performance of our User Agreement and to provide the escrow/payment services you request.

2. Regulatory Compliance & KYC — Identity Verification, Financial, Transaction

   Legal basis: Necessary to comply with our legal obligations under Kazakhstani anti-money laundering (AML), counter-terrorism financing (CFT), and financial regulations.

3. Legitimate Interests — Technical, Usage, Transaction, Communication

   Legal basis: Necessary for our legitimate business interests, which include:

   • Fraud detection and prevention.
   • Network and information security.
   • Service improvement and analytics.
   • Direct marketing (you have the right to object).

4. Consent — Marketing Communications, Precise Location, Special Category Data (if ever collected)

   Legal basis: We will only process based on your explicit, prior consent, which you can withdraw at any time.

5. How We Use Your Information

• To create, maintain, and secure your account.
• To verify your identity and conduct necessary KYC/AML checks.
• To facilitate payments, hold funds in escrow, and release funds according to agreements.
• To detect, prevent, and investigate fraud, security breaches, and prohibited activities.
• To communicate with you about transactions, account alerts, security updates, and support requests.
• To improve, personalize, and develop our Services, including through data analysis and testing.
• To comply with all applicable laws, regulations, and requests from law enforcement or regulatory bodies.
• To send you marketing and promotional communications (only with your consent).

6. How We Share Your Information

We do not sell your personal data. We share it only in the following circumstances:

• With Other Users: Necessary transaction details (e.g., username, rating, city) are shared with the counterparty to facilitate the trade.

• With Service Providers: We use trusted third parties who process data on our behalf under strict contracts ("data processors"), such as cloud hosting providers, payment processors, identity verification services, customer support platforms, and analytics providers.

• For Legal Reasons: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of EvoPay, our users, or the public.

• Business Transfers: In connection with a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as a business asset.

• With Your Consent: For any other purpose, we will share your data only with your explicit permission.

7. International Data Transfers

Your personal data is primarily stored and processed on secure servers within the Republic of Kazakhstan. However, some of our service providers may be located in other countries. In such cases, we ensure an adequate level of protection is maintained by:

• Using only providers in countries deemed adequate by relevant authorities, or
• Implementing Standard Contractual Clauses or other approved legal mechanisms for cross-border data transfer.

8. Data Security

We implement robust technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS/SSL) and at rest.
• Strict access controls and authentication protocols.
• Regular security audits and penetration testing.
• Employee training on data protection and confidentiality.

Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law (e.g., for regulatory, tax, or accounting purposes).

Account Data: Retained for 5 years after account closure for regulatory compliance.

Financial & Transaction Records: Retained for at least 7 years as required by financial legislation.

KYC/AML Records: Retained for 7 years after the end of the business relationship.

Marketing Data: Retained until consent is withdrawn.

After the retention period, your data will be securely deleted or anonymized.

10. Your Rights and Choices

Under Kazakhstani law, you have the following rights regarding your personal data:

• Right of Access: To request a copy of the personal data we hold about you.

• Right to Rectification: To correct inaccurate or incomplete data.

• Right to Erasure ("Right to be Forgotten"): To request deletion of your data, subject to legal limitations.

• Right to Restriction of Processing: To request we temporarily stop processing your data under certain conditions.

• Right to Object: To object to processing based on our legitimate interests.

• Right to Data Portability: To receive your data in a structured, machine-readable format.

• Right to Withdraw Consent: To withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, please contact us at dpo@evopay.kz. We may need to verify your identity before responding. You also have the right to lodge a complaint with the competent data protection authority in Kazakhstan.

11. Cookies and Tracking Technologies

We use cookies to ensure the proper functioning, security, and analytics of our website. You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our Services. Please see our detailed Cookie Policy for more information.

12. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will take steps to delete it promptly.

13. Changes to This Privacy Policy

We may update this Policy periodically to reflect changes in our practices, services, or legal requirements. The "Last Updated" date at the top will indicate when changes were made. We will notify you of significant changes via email or a prominent notice on our platform. Your continued use of the Services after such changes constitutes your acceptance of the updated Policy.