Modu Privacy Policy (Kazakhstan)

At Modu, we're building radically different financial products for businesses, and trust is the gravity that holds it all together. In Kazakhstan, that means handling your Personal Data in line with the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V dated May 21, 2013 (the “Law”), and being transparent about it with you.

This Privacy Policy (“Privacy Policy”) describes how Modu Technologies LLP, together with its affiliates (collectively “Modu,” “we,” “our,” or “us”), collects, uses, discloses, and protects your Personal Data as a data owner (оператор) under the Law, and the rights you have regarding it.

This Privacy Policy applies to our Kazakhstan business (the “KZ Services”): Modu's websites, mobile applications, and financial products offered to businesses registered in the Republic of Kazakhstan, as well as when you communicate or interact with Modu, including through email, referrals, or other marketing activities we may conduct.

“Personal Data” means information relating to an identified or identifiable individual, recorded on any medium. Personal Data does not include:

• publicly available information
• de-identified or aggregated information that cannot reasonably identify you

This Policy governs KZ Services specifically. If you use Modu's US Services, the separate US Privacy Policy applies.

2.1. Categories of Personal Data

We collect information necessary to open and operate your account and to comply with our legal obligations, including:

• Identification data — full name, date and place of birth, citizenship, IIN (individual identification number), passport or ID card details, address of residence and registration.
• Contact information — phone number, email address, mailing address.
• Financial and business data — BIN, bank account details, transaction history, account balances, ownership structure, and constitutive documents of your company.
• Professional information — job title, role in the company, ownership percentage.
• Biometric data — a photograph or facial scan used to verify your identity during onboarding, and any other biometric data you provide for identification purposes.
• Technical data — device identifiers, IP address, browser characteristics, log files, cookies, and similar technologies.
• Other information you choose to provide when contacting us for support or otherwise using the KZ Services.

Special categories of Personal Data. Under the Law, certain data requires your separate written consent to process, including data revealing race or ethnic origin, political views, religious or other beliefs, health status (including welfare and pension records), sex life, and criminal record. We do not collect or process these categories unless strictly necessary (for example, sanctions or PEP screening required by AML law) and only with the legal basis the Law requires.

2.2. Personal Data We Process on Behalf of Your Business

If you use Modu for business purposes, we may process Personal Data about individuals connected to your company, including:

• Founders, directors, and beneficial owners
• Employees and contractors
• Authorized users of your Modu account
• Vendors and other payment recipients
• Your customers, where relevant to invoicing or payment features

We collect this data when you or your company provide it to us directly, or when it is transmitted through your use of the Services (for example, when you issue an invoice naming a customer, or invite a team member).

Where we process Personal Data on behalf of your company, we do so under our agreement with your company and applicable law. Your company is responsible for having a lawful basis to provide that data to Modu — for example, the consent of its own employees or customers, where required.

We collect information in three main ways:

Directly From You

• When you apply for or open an account
• When you use the Services
• When you communicate with us
• When you invite team members or refer others to Modu

Automatically Through Your Use of the Services

We collect information automatically through cookies, device identifiers, and log files when you interact with our website or applications.

From Third Parties

We may receive Personal Data about you from:

• Identity-verification and KYC/AML screening providers.
• Our licensed banking partner in the Republic of Kazakhstan and payment infrastructure providers, to process transactions and comply with financial regulation.
• Government registries and databases (e.g., the state business registry) to verify company formation and beneficial ownership.
• Credit bureaus operating in Kazakhstan, to assess creditworthiness where relevant to our Services.

We use Personal Data to:

• Open and operate your account, including identity verification (KYC) and business verification required by Kazakhstani AML/CFT legislation.
• Process transactions you initiate, including invoicing and payment processing, and route them through our licensed banking partner.
• Detect, prevent, and investigate fraud, and maintain the security of our Services.
• Comply with our obligations under Kazakhstani law, including reporting to the National Bank of Kazakhstan, tax authorities, and financial-monitoring bodies where required.
• Communicate with you about your account and the Services.
• Improve and develop our products, including troubleshooting and research on de-identified or aggregated data.
• Process your requests, such as connecting a third-party integration.
• Any other purpose you have separately consented to, which you may withdraw at any time with respect to future processing.

We retain Personal Data only as long as necessary, considering:

• The duration of our relationship and provision of the Services
• Statutory recordkeeping requirements under Kazakhstani financial, tax, and AML/CFT legislation
• The need to prevent fraud and maintain security
• The need to resolve disputes and enforce our agreements

Because Modu operates in a regulated financial environment, certain records may be retained for extended periods after account closure, as required by law.

We may disclose your Personal Data to:

• Affiliates and subsidiaries that support our core business functions.
• Service providers who process data on our behalf — for example, identity-verification providers, cloud infrastructure, and customer support tooling — under a data-processing agreement.
• Our licensed banking partner in the Republic of Kazakhstan and payment/card infrastructure providers, to execute transactions.
• The National Bank of Kazakhstan, tax authorities, financial-monitoring and law-enforcement bodies, and courts, where required by Kazakhstani law.
• Credit bureaus operating in Kazakhstan, where relevant to our Services.
• A successor entity in a merger, acquisition, or reorganization of our business.
• Other third parties based on your request or authorization.

We do not sell your Personal Data.

We may share information that has been de-identified or aggregated such that it cannot reasonably be linked to you, to improve our Services and understand usage trends.

7.1. How we use AI

We use artificial intelligence (“AI”) and machine learning to enhance security and deliver efficient services — for example, to verify documents, categorize businesses and transactions, and detect fraud. We do not rely on AI alone for decisions that could have legal or financial consequences for you; such decisions always involve human oversight. We regularly review our AI systems for accuracy and security.

We use cookies, log files, and similar technologies (“Tracking Technologies”) to operate, secure, and improve the Services. These help us authenticate users, prevent fraud, and understand product performance. Where required by law, we rely on your consent for non-essential cookies.

8.1. What are Cookies?

Cookies are small text files stored on your browser or device when you visit a website. They help the website recognize your device, remember preferences, and understand how the site is used.

8.2. The Cookies We Use

The table below lists the cookies our Services set today. As we add analytics or advertising tooling, we will update this table before those cookies are set.

8.3. Managing Cookies

You can manage or block cookies through your browser settings. Please note that blocking essential cookies may prevent parts of the Services from working.

Under the Law of the Republic of Kazakhstan “On Personal Data and Its Protection”, you have the following rights with respect to your Personal Data:

• Right to information — to receive information about whether we process your Personal Data, and about the purposes, sources, and terms of that processing.
• Right of access — to obtain a copy of the Personal Data we hold about you.
• Right to correction — to request that we correct inaccurate or incomplete Personal Data.
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time with respect to future processing.
• Right to object/restrict — to object to or request that we restrict certain processing, subject to our legal obligations.
• Right to deletion or blocking — to request that we delete or block Personal Data that was collected unlawfully or is no longer necessary for the purposes it was collected, subject to our recordkeeping obligations under financial and tax law.
• Right to appeal — to file a complaint about our processing of your Personal Data with the authorized body for the protection of personal data rights, or with a court of the Republic of Kazakhstan.

How to exercise your rights

To submit a request regarding your Personal Data, please contact us at privacy@modu.kz. We will verify your identity before fulfilling your request and will respond within the timeframe required by the Law.

Modu's KZ Services are available to business customers. Personal Data in a business account is governed by our agreement with that business, including data about its employees, contractors, and other connected individuals. Please direct questions about data we process on behalf of a business directly to that business.

Modu currently uses infrastructure providers located outside the Republic of Kazakhstan (including within the European Union) to host and process Personal Data. We rely on your consent, given when you agree to this Privacy Policy and our Terms of Use, as the legal basis for this cross-border transfer, as permitted under Article 12 of the Law.

We take steps to ensure that any recipient of your Personal Data outside Kazakhstan applies safeguards consistent with the protections of the Law, including contractual data-protection commitments with our infrastructure and service providers.

As our Kazakhstan operations grow — including registration as a payment organization with the National Bank of Kazakhstan — we plan to establish Kazakhstan-resident data infrastructure for regulated data in line with applicable localization requirements. This Privacy Policy will be updated as that infrastructure is put in place.

We use administrative, technical, and organizational safeguards designed to protect your Personal Data from unauthorized access, use, or disclosure, though no system can be guaranteed 100% secure. If we are required by Kazakhstani law to notify you or the authorized body of an incident affecting your Personal Data, we will do so in accordance with that law.

Modu's KZ Services are built for businesses and are not directed at individuals who lack the legal capacity to independently enter into agreements under the Civil Code of the Republic of Kazakhstan. We do not knowingly collect Personal Data from minors outside the context of a parent, guardian, or authorized representative acting on their behalf.

We may update this Privacy Policy from time to time. If changes are material, we will update the 'Last Updated' date at the top of this page and provide notice where required by law. Changes take effect once posted on our website.

Questions about how we handle your Personal Data? Let's talk.

Contact us at privacy@modu.kz.