1.1. This Privacy Policy (hereinafter — the Policy) sets out the procedure for the processing and protection of the personal data of users of the «AJR» website, mobile application and platform (jointly and severally, hereinafter — AJR Services), including in connection with the conclusion and performance of Islamic financing agreements.
1.2. The Operator and Controller of personal data is Ajr Finance Limited (hereinafter — the Company), registered in the Astana International Financial Centre (AIFC).
1.3. The Policy has been developed in accordance with the AIFC Data Protection Regulations, the Law of the Republic of Kazakhstan «On Personal Data and Their Protection» (to the extent applicable to the Company’s activities), and the ethical principles of Islamic financing (including the principles of fairness ‘Adl and trust Amanah).
2. LAWFUL BASES FOR PROCESSING
The Company collects and processes Users’ personal data only where at least one of the following bases is present:
The User has given explicit, informed and voluntary consent to the collection and processing of data.
Collection and processing are necessary to provide access to AJR Services, and to approve, conclude and perform Contractual obligations (including Islamic financing agreements with clients and partnership agreements with suppliers).
Data is collected and processed on a mandatory basis in order to comply with AIFC requirements for KYC/AML procedures (verification of clients and counterparties, compliance and anti-money laundering measures).
3. CATEGORIES OF DATA AND MINIMISATION
Identification and profile data: Full name (surname, first name, patronymic, if any), date of birth, individual identification number (IIN), citizenship.
Contact data: Mobile phone number, email address, actual residential and/or registration address.
Documentary data: Scans/photographs of an identity card, passport or other identity document, as well as documents confirming the authority of suppliers’ representatives.
Financial information: Data on income, transactions and other information necessary to assess creditworthiness.
Technical parameters: Device model, IP address, browser type, operating system, login time, geolocation.
Data on the User’s actions in the application: Registration, login, identity confirmation, submission of applications, history of interaction with the AJR Services interface.
3.2. All data is collected directly from the User or through official partners (in particular, LLP “First Credit Bureau”), exclusively after obtaining the User’s consent.
3.3. The Company does not collect excessive data unrelated to the provision of financial services (hidden access to contacts, personal gallery or behavioural factors outside the scope of the AJR Services interface).
4. PURPOSES OF DATA USE
The Company collects and processes Users’ data for the following purposes:
Provision of services and registration: Identification of clients and initial verification of suppliers of goods/services, creation and configuration of a personal account, scoring, approval and conclusion of Agreements.
Marketing and informational communications: Sending the User news, special offers, promotional materials, information about promotions, and updates on products and AJR Services.
Communication and support: Providing feedback, sending notices on application status, SMS codes to confirm transactions, and responding to support requests.
Analytics: Improving the functionality of the website and mobile application interface, statistical analysis and content adaptation based on anonymised data.
The Company guarantees that it does not apply fully automated scoring decisions that produce legal consequences without human involvement. All key decisions are made by the Company’s employees.
5. NOTIFICATION, NOTICES AND THE FORM OF EXPRESSING CONSENT
5.1. When registering, submitting an application, undergoing initial identity verification, or concluding Islamic financing agreements in the mobile application or on the Company’s website, the User receives a notice that, in order to provide services and ensure security, their personal and biometric data will be collected and processed.
5.2. Before activating a service or using functions that require identification, the User is provided with a text notice describing the purposes, composition and scope of the data collected, retention periods and possible recipients, in accordance with this Policy.
5.3. The User confirms that, by clicking the “Agree” / “Continue” / “Accept” / “I Accept” button (or ticking the corresponding checkbox) in the AJR Services interface, they express their full, voluntary and informed consent to the collection and processing of personal and biometric data, including its transfer to and retrieval from LLP “First Credit Bureau” (FCB) and other authorised organisations.
5.4. The Company has the right to send the User notices relating to the use of their data, identity confirmation, changes to the Privacy Policy, technical updates or security matters. Such notices may be sent in the form of push notifications, SMS, email, or within the AJR Services.
6. INTERACTION WITH THIRD PARTIES
6.1. Within the framework of concluding and performing Islamic financing agreements, the Company may transfer the necessary personal data of the User to third parties: authorised suppliers of goods and services, dealers or asset owners, for the purpose of confirming specifications and prices, arranging delivery, and registering rights of use of property or services.
6.2. For the purposes of assessing creditworthiness, managing risk and complying with legal requirements, the Company may collect (request) information about the User from LLP “First Credit Bureau” (FCB) and other legitimate sources, and may transfer information on concluded Islamic financing agreements, and the amounts and terms of performance of obligations, to the FCB in accordance with the legislation of the Republic of Kazakhstan.
7. DATA RETENTION PERIODS AND PROCEDURE
7.1. All personal and biometric data of Users is stored in the Company’s centralised electronic database using secure technical means and information systems located on servers certified to information security standards (including ISO/IEC 27001, PCI DSS) and located within the Republic of Kazakhstan and/or in data centres accredited by the AIFC, solely for the period necessary to achieve the purposes set out in this Policy.
7.2. Data collected for the performance of contracts and to meet the KYC/AML requirements of AIFC and Republic of Kazakhstan legislation is stored for the entire term of the contractual obligations, as well as for 5 (five) years after their termination (in accordance with international standards for the archival storage of financial documents).
7.3. Data collected and processed for marketing, informational and communication purposes is stored until the User withdraws consent or until the AJR Services cease operation.
7.4. Upon achievement of the purposes of processing, expiry of the statutory periods, or withdrawal of consent by the User (in the absence of other lawful grounds for retention), the data shall be irrevocably destroyed or anonymised.
8. DATA PROTECTION AND SECURITY
8.1. The Company takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking or copying.
8.2. Access to the database is granted to a strictly limited circle of persons — employees and contractors of the Company whose functions are directly related to ensuring the identification, verification and servicing of Users. All such persons undergo vetting and training and bear personal responsibility for maintaining confidentiality.
8.3. The security of information exchange is ensured through the use of modern encryption protocols (SSL/TLS, and TLS 1.3 with the FCB infrastructure), the use of secure servers with restricted access, the implementation of multi-factor authentication (MFA), event logging, antivirus protection, and regular vulnerability testing
8.4. The Company guarantees that it does not transfer or store data in third countries that fail to provide an adequate level of protection for personal data under AIFC regulations. International data transfer is permitted exclusively to jurisdictions approved by the AIFC Data Protection Office (AIFC Data Protection Office), or on the basis of the Standard Contractual Clauses (Standard Contractual Clauses).
8.5. The Company is legally liable for the security of the database within the scope of its competence, but is released from such liability if the damage resulted from unlawful actions of third parties (hackers), provided the Company has complied with all technical protective measures, from negligence on the part of the User (disclosure of passwords to third parties), or from force majeure circumstances.
9. SECURITY GUARANTEES AND RESTRICTIONS ON DATA TRANSFER
9.1. The Company guarantees that Users’ personal and biometric data shall not be sold, exchanged or distributed for commercial purposes. Any processing of data is carried out exclusively for the purposes of providing Islamic financing services and identity verification on lawful grounds.
9.2. Transfer of data to third parties without the User’s consent is strictly prohibited, except in cases involving the performance of Islamic financing agreements, the exchange of information with LLP “First Credit Bureau” (FCB), or in response to official requests from competent government authorities and courts. All partners are required to maintain a level of data protection no lower than the Company’s own standards.
9.3. The Company guarantees that it does not transfer or store data in countries that fail to provide an adequate level of protection for personal data under AIFC regulations. International transfer of data is permitted only with the User’s explicit consent.
9.4. In the event a data breach or unauthorised access to data is identified, the Company undertakes to contain the incident, conduct an investigation, and, within 72 hours, notify the Astana Financial Services Authority (AFSA), the authorised bodies of the Republic of Kazakhstan, and the affected Users. The notice to the User shall indicate the risks involved, the list of compromised data, and recommendations for protecting the account.
9.5. The database of Users is protected property of the Company. The Company is legally liable for its security, but is released from such liability if the damage resulted from the actions of hackers (provided the Company has complied with all technical protective measures), from negligence on the part of the User (disclosure of passwords to third parties), or from force majeure circumstances.
10. USER RIGHTS UNDER THE AIFC RULES (AIFC RIGHTS)
10.1. In accordance with theAIFC Data Protection Regulations, the User has the following rights:
to know what data is held about them and to receive a copy of it;
to request correction of inaccurate or outdated data;
to request deletion of data if it is no longer required for the purposes of processing (except for the Company’s statutory archival obligations relating to financial records).
to withdraw consent to marketing, communications or biometric data collection at any time (through the application settings or by contacting support).
11. DATA PROTECTION OFFICE (DATA PROTECTION OFFICER)
11.1. The Company has appointed a person responsible for organising the processing and protection of personal data, who oversees compliance with Users’ privacy.
11.2. All requests relating to the exercise of rights, withdrawal of marketing consent, or clarification of this Policy should be sent to: info@ajr.kz. The Company undertakes to review the request within 30 calendar days.
12. AMENDMENTS TO THE POLICY
The Company reserves the right to amend this Policy. In the event of material changes, the Company shall notify Users through the Application interface or by email at least 10 days before the changes take effect.
CONSENT TO THE COLLECTION AND PROCESSING OF PERSONAL DATA
I, acting as a User of AJR Services (either as an individual client, or as an authorised representative/employee of a supplier of goods and services), freely, of my own will and in my own interest, give my explicit, informed and voluntary consent to the Operator and Controller of data — Ajr Finance Limited (AIFC, Astana), hereinafter — the Company, to collect, process, store and protect my personal and biometric data on the following terms.
List of data collected: Full name, date of birth, individual identification number (IIN), mobile phone number, email address, actual residential and/or registration address, citizenship, documentary data (photo/scan of an identity card or passport), biometric data (facial image, video, voice, fingerprints, “liveness” parameters Liveness check), device technical data (model, IP address, browser type, geolocation, login time), and data on my actions in the AJR application.
2. Purposes of collection and processing:
Registration, initial identity verification, creation of a personal account, and provision of access to AJR Services.
Conducting scoring, compliance control and KYC/AML checks in accordance with the requirements of AIFC legislation.
Approval, conclusion and performance of Islamic financing agreements and cooperation agreements with suppliers.
Ensuring operational interaction between clients and suppliers of goods/services on the platform.
Sending service, transactional and legal notices, as well as (subject to separate consent) marketing materials that comply with Shariah ethical standards.
3. I hereby give the Company my explicit consent to:
Requesting and obtaining information about me, my credit history, income and obligations from LLP “First Credit Bureau” (FCB) and other legitimate sources, for the purposes of risk and creditworthiness assessment.
Transferring information about my obligations under Islamic financing agreements, and the amounts and terms of their performance, to LLP “First Credit Bureau” (FCB) in accordance with legal requirements.
Transferring the necessary identification and contact data to suppliers of goods and services, dealers or asset owners registered on AJR Services, for the purpose of confirming specifications and prices, arranging delivery and registering my rights of use.
Transferring the necessary data to Islamic insurance (Takaful) organisations — for the purposes of compulsory or voluntary insurance of the subject matter of the Islamic lease (Ijara) in accordance with Shariah standards.
Transferring data to KYC/AML service providers and credit bureaus — for remote verification of document authenticity, biometric matching and risk assessment.
Transferring information to judicial, law enforcement and regulatory authorities, including the Astana Financial Services Authority (AFSA), exclusively in response to lawful and official requests.
4. Retention period and place of storage. Data is stored in the Company’s electronic database on secure servers physically located within the Republic of Kazakhstan, for the term of my agreements with the Company, as well as for 5 (five) years after their termination (in accordance with the archival KYC/AML requirements of AIFC financial legislation).
The User grants the Company the right to transfer their personal data (to the extent necessary for the performance of obligations) to the following third parties:.
5. Withdrawal of consent. I have been informed that I have the right to withdraw this Consent at any time. Opting out of marketing mailings is done through profile settings or by clicking the “Unsubscribe” button. Full withdrawal of consent to the processing of data for financial services is carried out by sending a written request to the email address: info@ajr.kz (provided that the Company retains the right to continue storing the data until the expiry of the 5-year statutory archival period).