Privacy Policy

1. Who We Are

This privacy policy applies to BlackSteppe (“BlackSteppe”, “we”, “us” or “our”), an investment platform registered at Mangilik El Avenue 55, AIFC, Astana 020000, Republic of Kazakhstan. Our investor relations contact is [email protected].

This policy explains how we collect, use and protect personal data obtained through blacksteppe.com (the “Site”). Please read it carefully before submitting any information to us.

2. Information We Collect

We collect personal data only when you voluntarily provide it. This occurs when you submit an enquiry or investor materials request through our contact forms. The information we may collect includes:

• Full name
• Email address
• Organisation or employer name
• Investor type or category
• The content of any message you send us

We do not collect payment information, government identification numbers or sensitive personal data through this Site. We do not collect any information automatically other than standard server log data (such as IP address and browser type) that is generated when any website is accessed.

3. Cookies and Tracking

This Site does not use advertising cookies, tracking pixels or third-party analytics services. Our website forms are processed by Netlify, whose infrastructure may set functional cookies necessary for form submission. No cookies are used for marketing, behavioural targeting or cross-site tracking.

4. How We Use Your Information

Personal data submitted through this Site is used solely for the following purposes:

• To respond to your enquiry or request for investor materials
• To conduct KYC, AML and investor suitability checks as required by applicable regulations before providing any investment-related materials or documentation
• To maintain records of investor relations contacts as required by applicable law and regulation

We do not use your data for automated decision-making or profiling. We do not send unsolicited marketing communications. Any communication we send will be directly related to an enquiry you have initiated.

5. Legal Basis for Processing

Where applicable data protection law requires a legal basis for processing, we rely on the following:

• Contract performance: where processing is necessary to respond to your enquiry or take steps at your request
• Legitimate interests: maintaining investor relations records and conducting compliance screening
• Legal obligation: where processing is required to comply with applicable KYC, AML or financial regulation

6. Data Sharing and Disclosure

We do not sell, rent or share personal data with third parties for commercial purposes. We may share data in the following limited circumstances:

• Service providers: Netlify (form processing and hosting infrastructure). Netlify processes form data in accordance with its own privacy policy and GDPR-compliant data processing terms.
• Professional advisers: legal, compliance or regulatory advisers where required for a transaction or regulatory process, under strict confidentiality obligations
• Legal requirements: where we are required by law, court order or regulatory authority to disclose information

7. Data Retention

We retain personal data for as long as is necessary for the purpose for which it was collected, or as required by applicable law or regulation. Enquiry and investor relations records are generally retained for a minimum of five years in line with financial industry record-keeping requirements. Where data is no longer required, it is securely deleted.

8. Your Rights

Subject to applicable law, you may have the following rights in respect of personal data we hold about you:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate data
• The right to request deletion of your data (subject to legal retention obligations)
• The right to object to or restrict certain processing
• The right to data portability in certain circumstances

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing a request.

9. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. Form submissions are transmitted over encrypted connections (HTTPS). Access to personal data is restricted to authorised personnel on a need-to-know basis.

10. International Data Transfers

This Site and its hosting infrastructure may involve the transfer of personal data across international borders. Where such transfers occur, we take steps to ensure that appropriate safeguards are in place in accordance with applicable data protection law.

11. Third-Party Links

This Site may contain links to third-party websites. This policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this privacy policy from time to time. The effective date at the top of this page will be updated accordingly. Material changes will be communicated where practicable. Continued use of the Site after any update constitutes acceptance of the revised policy.

13. Contact

For any questions about this privacy policy or our data practices, please contact:

BlackSteppe — Investor Relations
Mangilik El Avenue 55, AIFC, Astana 020000, Republic of Kazakhstan
[email protected]