Privacy and Personal Data Processing Policy

Website Administrator of polis24.kz — Generate LLP | BIN 090940017637 Version dated 15 October 2026

1. Purpose and scope

This Policy governs the processing of personal data of visitors, applicants, policyholders, insured persons, beneficiaries and other persons when using the website https://polis24.kz/ and its associated communication channels.

Generate LLP (Business Identification Number (BIN) 090940017637), hereinafter the Administrator, acts as the owner and/or operator of the data processed through the website within the scope of its functions. Insurance companies to which information is transferred at users' request independently determine the terms for processing the data they receive within their authority and applicable legislation.

This Policy applies to applications, insurance calculators, online forms, personal accounts (where available), correspondence, telephone enquiries, and document workflows relating to arranging insurance and insured events. It does not replace insurers' insurance rules or contracts.

2. Terms and legal grounds

Personal data, data subject, owner, operator, collection, processing, transfer to a third party, blocking, deletion, destruction and anonymisation have the meanings given in the Law of the Republic of Kazakhstan «On Personal Data and Their Protection».

Processing is carried out on the basis of documented consent from the data subject (or their legal representative); without such consent, processing is permitted only in cases expressly provided for by law. The principles are lawfulness, specific purposes, data minimisation, confidentiality and security.

The Administrator acts as an insurance agent only within the scope of the current authority granted by the relevant insurance companies. The insurer and the party responsible for the insurance obligations under the policy is the insurance company specified in the contract.

3. Categories of information processed

When an enquiry is submitted: surname, first name, patronymic (if any), telephone number, email address, city, content of the enquiry, preferred method of communication and interaction history.

For preparing insurance offers and entering into a contract — where necessary and depending on the type of insurance: Individual Identification Number (IIN), date of birth, citizenship, identification document details, address, information about the insured object and property interest, vehicle details, registration number/VIN, driving experience, property characteristics, travel routes and dates, list of insured persons, coverage amount and risk information.

For insurance support: policy number and terms, premium and payment information, requests for amendments and renewal, correspondence, information about an event showing signs of an insured event, supporting documents, information about damage, losses, payment recipients and settlement details — only where necessary.

For medical, life and accident insurance, health information, diagnoses, medical documents and other sensitive information may be processed only where genuinely necessary, with appropriate consent and in compliance with legal requirements, including medical confidentiality. Access to this information is subject to additional restrictions.

Technical information: IP address, browser and device type, security log, interface activity, cookies and similar identifiers. Optional analytics and advertising cookies are used taking into account settings and legally required consent.

Third-party data (of drivers, family members, employees, insured persons and beneficiaries) is provided where the applicant has authority or another lawful basis; the applicant must not disclose information without such a basis.

4. Specified purposes of processing

Reviewing enquiries, providing advice on insurance products, calculating premiums, comparing offers and preparing tailored terms in response to a user's enquiry.

Identifying the policyholder and other participants in the insurance arrangement, preparing and submitting applications and questionnaires to insurers, arranging, amending, renewing and terminating insurance contracts, and carrying out the operations arising from them.

Supporting the customer during the insurance period, sending reminders about significant actions and policy expiry, providing information on existing contracts, liaising with the insurer regarding losses and payments, and handling enquiries and disputes.

Ensuring website security and fraud prevention, maintaining accounting and other mandatory records, and complying with lawful requirements of public authorities.

Sending advertising and marketing messages about new products and special offers — only with separate, voluntary and recorded consent, with an option to opt out. Anonymised statistics are permitted subject to compliance with legislation.

5. Transfer of data to insurance companies and other recipients

By providing separate, verifiable consent, the user authorises the Administrator to transfer the necessary personal data to one or more insurance companies in the Republic of Kazakhstan authorised to provide the relevant types of insurance, including to several insurers for obtaining and comparing quotations.

The information transferred may include data about the policyholder, insured person, beneficiary, insured object and risk, questionnaires, applications, documents concerning an insured event and payment details — solely to the extent necessary for the specific insurance transaction requested.

Transfer is permitted for underwriting, verifying information through available lawful sources, calculating rates, preparing and issuing a policy, maintaining insurance records, servicing and amending a policy, verifying the circumstances of an insured event, and arranging claims settlement and insurance payments.

Recipients may also include parties lawfully involved in the insurance procedure: assistance and expert organisations, loss surveyors, appraisers, medical institutions, reinsurers and payment organisations — at the insurer's initiative or through the insurer, and only in compliance with the applicable lawful basis and confidentiality requirements.

For website operations, technical providers of hosting, CRM, communications and support may receive limited access under confidentiality and data protection agreements; such access does not authorise independent marketing or use of the information for their own unapproved purposes.

The Administrator may transfer information to public authorities where there is a statutory basis and to the extent required. Personal data is not made publicly available to an unlimited number of persons without specific consent or a legal obligation.

6. Insurance secrecy and confidential information

Information about the sum insured, premium and contractual terms relating to the identity of the policyholder, insured person and beneficiary, and other information covered by Article 830 of the Civil Code of the Republic of Kazakhstan, is protected as insurance secrecy.

Data is provided to the insurer for arranging and implementing insurance in accordance with insurance legislation; information constituting insurance secrecy may be disclosed to other third parties only in cases provided for by law or with the appropriate written consent of the relevant person.

Employees and engaged contractors are granted access to information only as required by their duties and must maintain confidentiality.

7. Obtaining and recording consent

Consent on the website is given through a separate, deliberate action by the user — by ticking a box that is not pre-selected and submitting a form, or by another method allowing receipt of consent to be verified. The text version, date and time, verified applicant identifier, source, method and technical evidence of the expression of intent are recorded.

Consent must make it possible to identify: Generate LLP, BIN 090940017637; the data subject; categories of information; purposes; validity period; the possibility of transfer to insurance companies and other specified recipients; whether cross-border transfer takes place; and the absence of publication in publicly accessible sources.

Consent remains valid until the relevant processing purposes have been achieved and the related legal relationships have ended, taking into account mandatory retention periods under legislation and the contract. Consent to optional marketing is given and withdrawn independently of consent to processing for the provision of the requested service.

Simply browsing the website does not in itself constitute consent to the processing of questionnaire, medical or insurance data. Where access to data held in government digital systems is required, the government access control service and the established integration procedure are used.

8. Location, storage, retention periods and destruction

Personal data is accumulated and stored in databases and digital systems located within the Republic of Kazakhstan, with backups, role-based access controls and activity logging.

The specific retention period depends on the purpose: applications not accepted — until the enquiry is closed and a reasonable period for settling related claims has elapsed; insurance files — until servicing has ended, potential claims have been settled and mandatory retention periods for insurance, accounting and other documents have expired. Indefinite retention without a specific basis is not permitted.

Once the purpose has been achieved or the lawful basis has ceased to exist, data is destroyed, deleted or irreversibly anonymised, except for information that must be retained by law or because of an outstanding obligation. Backups are cleared according to an established cycle, with restricted access.

9. Cross-border transfer

The Administrator does not envisage cross-border transfer as a mandatory operation for a typical website enquiry. If a specific product (for example, international travel or medical insurance) requires information to be transferred to a foreign insurer, assistance provider or other contractor, the transfer takes place only in compliance with Article 16 of the Law of the Republic of Kazakhstan «On Personal Data and Their Protection» and insurance and medical confidentiality requirements, with the necessary information provided and separate consent obtained where required.

The use of foreign cloud, analytics and communications platforms is assessed separately for possible actual cross-border transfer; the primary database must be located in the Republic of Kazakhstan regardless of the lawfulness of any individual cross-border transfer.

10. Technical and organisational safeguards

The Administrator implements organisational and technical measures proportionate to the risks: appointing a responsible person, approving the list of data, access management, authentication, protection of communication channels, logging of significant operations, backups, software updates, antivirus protection, employee training and contractual obligations for providers.

In the event of a data security breach, measures are taken to contain and document the incident, minimise harm and notify the competent authority in the cases and within the time limits prescribed by law. Available information is provided in response to data subjects' requests within the limits of the law.

Automated decisions affecting rights and legitimate interests are subject to the requirements of Article 19-1 of the Law: information about the logic and consequences, the opportunity to object, and consideration of the objection within the prescribed time limits.

11. Data subject rights and enquiry procedure

The data subject has the right to find out whether data is processed and for what purposes, its sources, the categories of data and retention periods; to obtain access; to request the correction, blocking, destruction or deletion of unlawfully processed data; to withdraw consent; and to challenge the Administrator's actions.

A request is submitted using the contact details at the end of this Policy. After verifying the person's identity, the Administrator reviews the request within the statutory time limits; upon withdrawal of consent, the Administrator ceases processing within fifteen working days unless retention or continued processing is required by law or an outstanding obligation, or provides a reasoned refusal.

Withdrawal of consent necessary to obtain an insurance offer may make it impossible to arrange insurance or continue servicing through the Administrator, but does not automatically terminate an insurance contract already concluded. Opting out of advertising messages does not affect insurance servicing.

12. Cookies and third-party services

Necessary cookies support website functionality, user preferences, session stability and protection against misuse. Analytics and advertising technologies are used where the required grounds exist and a choice is available.

Third-party websites of insurers, payment services and other organisations are governed by their own policies; following a link does not constitute automatic consent to any processing of data by them.

13. Amendments and entry into force

This Policy is publicly available on the website and takes effect on the date of publication. New versions apply prospectively; any expansion of purposes, categories of data or recipients requiring new consent is introduced after that consent has been obtained.

The provisions of this Policy do not override mandatory requirements of the legislation of the Republic of Kazakhstan or the rights of personal data subjects.

Administrator details and enquiries

Administrator: Generate LLP, BIN 090940017637.

Website: https://polis24.kz/

Correspondence address (according to published details): Office 202, 498 Seifullin Avenue, Almaty, Republic of Kazakhstan.

Telephone: +7 (727) 225-40-40; email: info@generalre.kz.

Enquiries concerning personal data should be sent with the subject line «Personal Data»; before providing or correcting data, the Administrator may carry out reasonable verification of the applicant's identity.