Privacy Policy

1. Introduction

This Privacy Policy (hereinafter — the "Policy") describes how personal data of visitors and users of the website centralasiaexpo.kz (hereinafter — the "Site"), as well as participants and visitors of exhibitions organised by Central Asia Trade Exhibitions (hereinafter — the "Company", "We"), is collected, stored, used, transferred and protected.

The Policy has been drawn up in accordance with the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and its Protection", the European Union General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) and other applicable international standards.

By using the Site or providing us with personal data, you confirm that you have read this Policy and agree to its terms. If you do not agree with any of its provisions, please refrain from using the Site.

2. What data we collect

We only collect data that is necessary for lawful and pre-defined purposes. The categories of data processed are:

2.1. Data you provide to us directly

• First name and surname;
• Company name, position, industry;
• Email address and phone number;
• Country and city;
• Content of messages sent through contact forms;
• Data provided when registering as an exhibitor or visitor.

2.2. Data collected automatically

• IP address and approximate geographic location;
• Browser type and version, operating system, device type;
• Referrer source, pages viewed, session duration;
• Information about interactions with pages (clicks, scrolling) — in anonymised form;
• Cookie data (see the Cookie Policy for details).

2.3. Data received from third parties

In certain cases we may obtain data from publicly available sources (business directories, professional social networks) solely for the purposes of B2B business communication and only where there is a lawful basis.

3. Why we use your data

We use personal data strictly for the following purposes:

• Handling enquiries — responding to your request submitted via the contact form;
• Registration of exhibitors and visitors — organising participation, issuing badges and passes;
• Business communication — invitations to exhibitions, information on participation status;
• Marketing mailings — only with explicit opt-in consent and with an unsubscribe option at any time;
• Analytics and Site improvement — analysis of anonymised data on visits and user behaviour;
• Fulfilment of contractual obligations — concluding and performing contracts with exhibitors and partners;
• Legal compliance — accounting, tax and other mandatory reporting.

4. Legal grounds for processing

We process your data only when at least one of the following legal grounds applies (Article 6 GDPR, Articles 7–8 of the Law of the Republic of Kazakhstan No. 94-V):

• Consent of the data subject — explicit, voluntary and informed consent (for example, when subscribing to the newsletter or accepting cookies);
• Performance of a contract — the data is necessary to conclude and/or perform a contract with you;
• Legitimate interest — for example, fraud prevention, Site security and B2B communication in the course of professional activity;
• Compliance with a legal obligation — requirements of Kazakhstani tax, accounting and other legislation;
• Protection of vital interests — in exceptional cases (for example, emergencies at the exhibition venue).

5. To whom we may transfer data

We do not sell or rent your personal data. Transfer of data to third parties is only possible in the following cases:

• Service providers — IT infrastructure, email campaigns, analytics, badge printing. All contractors are bound by confidentiality and data-processing agreements;
• Public authorities — upon official request under applicable law;
• Exhibition partners — for example, the operator of Atakent IEC — to provide access to the exhibition (only the minimum necessary data);
• Corporate restructuring — in the event of a merger, asset sale or other succession (with notification to data subjects).

Transfers of data outside the Republic of Kazakhstan only take place to countries that ensure an adequate level of data protection or where appropriate safeguards are in place (standard contractual clauses).

6. Retention period

We retain personal data only for as long as necessary to achieve the purposes of processing:

• Enquiry data — up to 2 years after the last contact;
• Exhibition participant data — up to 5 years after the event closes (for reporting and engagement history);
• Marketing mailing data — until the user withdraws consent;
• Accounting records — in accordance with the requirements of Kazakhstani tax law (typically 5 years);
• Cookies — retention periods are specified in the Cookie Policy.

Once the retention period expires, the data is deleted or anonymised.

7. Your rights

Under Kazakhstani law and the GDPR you have the following rights with regard to your personal data:

7.1. Right of access

You may request confirmation as to whether your data is being processed and obtain a copy of the data processed.

7.2. Right to rectification

You may request the correction of inaccurate data or the completion of incomplete data about you.

7.3. Right to erasure ("right to be forgotten")

In the cases provided for by law, you may request the deletion of your data.

7.4. Right to restriction of processing

You may request a temporary suspension of data processing in disputed cases.

7.5. Right to data portability

You may receive your data in a structured, machine-readable format and transmit it to another controller.

7.6. Right to object

You may object to processing based on legitimate interest, including direct-marketing communications.

7.7. Right to withdraw consent

If processing is based on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before the withdrawal.

7.8. Right to lodge a complaint

You have the right to lodge a complaint with the competent personal data protection authority of the Republic of Kazakhstan or with the supervisory authority of your country of residence (for EU residents).

To exercise any of these rights, please send a request to dpo@centralasiaexpo.kz. We will respond within 30 calendar days.

8. Data security

We take reasonable and proportionate organisational and technical measures to protect your data against unauthorised access, modification, disclosure or destruction:

• Encryption of data in transit via HTTPS (TLS 1.2 or higher);
• Access to data restricted on a need-to-know basis;
• Regular backups and integrity checks;
• Logging of actions involving personal data;
• Staff training on information security;
• Confidentiality agreements with contractors.

In the event of a data security breach that may pose a risk to the rights and freedoms of data subjects, we will notify the competent authority and affected data subjects within the time limits set by law.

9. Cookies

We use cookies and similar technologies to operate the Site, for analytics and for marketing. Detailed information on cookie categories, retention periods and preference management is available in the Cookie Policy.

10. Children

The Site is intended for a professional B2B audience and is not directed at persons under 16 years of age. We do not knowingly collect data about minors. If you are a parent or legal guardian and believe that your child has provided us with personal data, please contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. The current version is always available at centralasiaexpo.kz/en/privacy.html. We will notify you of any material changes on the Site or by email.

12. Data Protection Officer contacts

For any questions concerning the processing of personal data, please contact:

• Data controller: Central Asia Trade Exhibitions
• Address: Samal-1, 9/2, 5th floor, #43, Almaty 050059, Republic of Kazakhstan
• Data Protection Officer: dpo@centralasiaexpo.kz
• General email: info@centralasiaexpo.kz
• Phone: +7 (727) 266 36 80

Effective date: 15 May 2026
Last updated: 15 May 2026