Privacy Policy

Privacy Policy

Business Media Central Asia LLP

Version of 30 October 2026

1. General Provisions
This Privacy Policy (the "Policy") sets out the procedure for the collection, processing, storage and protection of personal data that Business Media Central Asia LLP (the "Operator", "BMCA") obtains through its websites, upon registration for events and in business correspondence. The Policy enters into force on 1 November 2026 and supersedes all previously published versions, including the policy on the website subscription.bmca.kz.
1.1. The Policy has been drawn up in accordance with the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection" (the "Law") in the version in force from 25 August 2026, the Digital Code of the Republic of Kazakhstan No. 255-VIII of 9 January 2026, the Rules for the collection and processing of personal data approved by Order of the Minister of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan No. 395/НҚ of 21 October 2020, and the Rules for the implementation of personal data protection measures by the owner and (or) operator, as well as by a third party, approved by Order No. 179/НҚ of 12 June 2023.
1.2. The Policy applies to the following websites of the Operator, including their language versions (/ru, /kz, /en) and subdomains.

Website	Purpose
bmca.kz	BMCA corporate website, careers, contacts
automechanika.kz	Automechanika Astana trade fair
comtrux.kz	Comtrux Astana trade fair
bautrux.kz	Bautrux Astana trade fair
scalex.kz	SCALEX Astana forum
aerex-expo.kz	AEREX Astana trade fair
subscription.bmca.kz	Subscription forms for BMCA mailings

1.3. The Policy also applies to personal data that the Operator obtains outside the websites in connection with the preparation and holding of its events. Such channels include online registration of visitors and exhibitors, registration desks at events, badge scanning, business correspondence by email and in messengers, telephone conversations and the exchange of business cards.
1.4. The Policy applies to the websites of new events of the Operator from the moment a link to this Policy is placed on them.
1.5. Use of the websites means that the user has read the Policy. Consent to the collection and processing of personal data is given separately in the form set out in Appendix 1 when completing a form on the website or when registering for an event.
1.6. For users located in the European Union and the European Economic Area, the provisions of clause 12.8 of this Policy, based on Regulation (EU) 2016/679 (GDPR), additionally apply.
2. Key Terms
The terms are used in the meaning established by Article 1 of the Law. For the purposes of this Policy, the following definitions additionally apply.
2.1. Personal data. Information or a set of information about a personal data subject, supplemented by one or more personal data identifiers (surname, first name, patronymic, email address, telephone number, cookie identifier and others).
2.2. Personal data subject (also the "user", the "subject"). A natural person to whom the personal data relate, including a website visitor, an event visitor, a representative of an exhibitor, partner, media outlet or state body, or a job applicant.
2.3. Operator. Business Media Central Asia LLP, which independently determines the purposes and composition of the personal data processed and carries out their collection, processing and protection.
2.4. Collection of personal data. Actions aimed at obtaining personal data.
2.5. Processing of personal data. Actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalisation, blocking and destruction of personal data.
2.6. Third party. A person who is neither the subject nor the Operator but is connected with them by legal relations concerning the collection, processing and protection of personal data. Third parties include, among others, the providers of technical services specified in Section 8.
2.7. Cross-border transfer of personal data. Transfer of personal data to the territory of foreign states.
2.8. Cookies. Small text files that a website stores on the user's device in order to recognise the browser, save settings and collect visit statistics.
2.9. Event. A trade fair, forum, conference, business programme or other event of which the Operator is the organiser or the technical provider.
2.10. Registration provider. A third party that, under a contract with the Operator, provides online registration of visitors, issuance of electronic tickets, printing of badges and badge scanning at the event.
2.11. Authorised body. The central executive body that exercises management in the field of personal data protection. As at the date of approval of the Policy, this is the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan (Information Security Committee).
3. Information about the Operator and Contact Details
3.1. Personal data operator. Limited Liability Partnership "Business Media Central Asia", BIN 180540003651. Registered address 010000, Republic of Kazakhstan, Astana, Mangilik Yel Avenue, building 53/1. Telephone +7 (717) 264-22-10, email info@bmca.kz.
3.2. The Operator is the official representative of Messe Frankfurt in Central Asia and the technical provider of the EXPO International Exhibition Centre in Astana. The Operator acts as the owner and operator of digital objects containing personal data within the meaning of Article 1 of the Law.
3.3. In accordance with subparagraph 10) of paragraph 2 of Article 25 of the Law, the Operator appoints a person responsible for organising the processing of personal data. Requests from subjects concerning personal data shall be sent to this person at info@bmca.kz with the subject line "Personal Data" or by post to the registered address of the Operator.
3.4. A request must contain the surname, first name and patronymic of the subject, contact details for a reply, the substance of the request and information allowing the subject's personal data to be located at the Operator (for example, the email address from which the form was completed or the name of the event). The Operator may request proof of identity where this is necessary to protect the subject's data from disclosure to third parties.
4. List of Personal Data Processed
The Operator processes only the data that the user provides personally and the technical data that the browser transmits automatically. The composition of the data for each collection channel is set out in the table. The Operator does not collect personal data of restricted access (biometric data, information on health, ethnicity, religious and political beliefs) and does not collect copies of identity documents.

Collection channel	Personal data	Where collected
Participation application and stand booking	Name, position, company, country, telephone, email, type of activity of the company, desired stand area, comment	"Book a stand" forms on the event websites
Request via the feedback form	Name, email, telephone, company, text of the message	Pages /feedback and /contacts
Subscription to news	Name, email, selected mailing topics	Pages /subscribe and subscription.bmca.kz
Visitor registration and electronic ticket	Surname, first name, patronymic, company, position, country and city, field of activity, email, telephone, visitor category	Registration pages of the registration provider, registration desks at the event
Badge scanning at an exhibitor's stand	Data provided at registration, date and time of scanning	At the event, at the visitor's initiative
Accreditation of journalists	Surname, first name, patronymic, media outlet, position, email, telephone, country	Pages /press/media-accreditation
Application to take part in the business programme	Surname, first name, patronymic, company, position, email, telephone, topic of presentation	Business programme and Academy pages
Personal account on the website	Email, password in hashed form, profile data	"Personal Account" section on the event websites
Job applicants	Surname, first name, patronymic, contact details, information on education and work experience, other information from the CV	HR manager's email, job search platforms
Business correspondence and messengers	Name, telephone number, email, company, position, content of correspondence	Email, WhatsApp, telephone, business cards
Photo and video recording at events	Image and voice of a participant as part of reportage recording	Event venue
Technical data (automatic)	IP address, device and browser type, language, referral source, pages viewed, date and time, cookie identifiers	All websites of the Operator

4.1. Mandatory form fields are marked on the websites with the symbol "*". Without these data the Operator cannot process an application, issue a ticket or respond to a request. The remaining fields are completed at the user's discretion.
4.2. When a badge is collected at the registration desk, an employee of the Operator may check the name on the badge against an identity document without copying or retaining the document.
4.3. Scanning of a visitor's badge at an exhibitor's stand is carried out only at the visitor's decision. From the moment of scanning, the exhibitor receives the visitor's contact details and processes them as an independent operator in accordance with its own policy.
5. Purposes and Legal Grounds for Processing
The legal ground for processing is the consent of the subject given in accordance with Article 8 of the Law. Without consent, the Operator processes personal data only in the cases expressly listed in Article 9 of the Law, including when complying with the requirements of accounting legislation and tax legislation. The Law does not provide for processing on the basis of the operator's "legitimate interest", and the Operator does not rely on such a ground.

Purpose of processing	Data	Legal ground
Preparation of a commercial offer, conclusion and performance of an event participation contract	Participation application, business correspondence	Consent of the subject, contract with the exhibitor
Responding to user requests	Feedback form, messengers	Consent of the subject
Registration of visitors, issuance of electronic tickets and personalised badges, access control at the event	Visitor registration	Consent of the subject, event attendance rules
Media accreditation and organisation of the business programme	Accreditation, speaker applications	Consent of the subject
Informational and advertising mailings about the Operator's events	Subscription, visitor registration, participation application	Separate consent of the subject to mailings
Recruitment	CVs of job applicants	Consent of the subject
Website and event attendance statistics, website improvement, evaluation of advertising campaigns	Technical data, cookies, depersonalised registration data	Consent of the user in the cookie notice
Photo and video reports on events, press materials	Recording at events	Consent of the subject at registration, notice at the venue
Performance of obligations established by laws	Contractual and payment documents	Article 9 of the Law, accounting legislation

5.1. The Operator uses personal data only for the purposes declared at the time of their collection (Article 14 of the Law). Processing for a new purpose is permitted only after new consent has been obtained.
5.2. The Operator does not take decisions that create, change or terminate the rights of the subject solely on the basis of automated processing of personal data (Article 19-1 of the Law). Automatic registration confirmations and electronic tickets are generated at the request of the subject and do not create legal consequences for the subject.
5.3. The Operator does not disseminate personal data in publicly available sources without the separate consent of the subject. Lists of business programme speakers and exhibitor representatives are published with the consent of those persons.
6. Consent of the Subject and Procedure for Its Withdrawal
Consent is given in a manner that allows its receipt to be confirmed (Article 8(1) of the Law). On the Operator's websites, this manner is the user ticking the consent field below the form and clicking the submit button. The Operator retains the date, time, page address and content of the consent as evidence of its receipt (subparagraph 5) of paragraph 2 of Article 25 of the Law).
6.1. The text of the consent complies with Article 8(4) of the Law and contains the name and BIN of the Operator, the list of data collected, the term of validity of the consent, and information on the transfer of data to third parties, on cross-border transfer and on dissemination in publicly available sources. The text is set out in Appendix 1.
6.2. Consent to mailings is given separately from consent to the processing of an application. The mailing consent field cannot be ticked in advance, and refusal of mailings does not affect the processing of the application, registration or issuance of a ticket.
6.3. The term of validity of the consent does not exceed the period necessary to achieve the purposes of processing (Article 8(5) of the Law). The specific periods are set out in Section 10.
6.4. The subject may withdraw consent at any time by sending a request to info@bmca.kz, by clicking the "Unsubscribe" link in an email or through the personal account on the website. The Operator ceases processing within fifteen working days from the date of receipt of the withdrawal (Article 8(7) of the Law), except where processing is necessary for the performance of an outstanding obligation or is expressly provided for by the laws of the Republic of Kazakhstan (Article 8(2) of the Law).
6.5. Withdrawal of consent does not affect the lawfulness of processing carried out before its receipt.
6.6. The Operator does not collect personal data of persons under eighteen years of age. If the Operator becomes aware of such a registration, the data are deleted.
7. Cookies, Analytics and Third-Party Services on the Websites
The Operator's websites use the Tilda platform's own cookies and the cookies of third-party analytics and advertising services. Cookie identifiers in combination with an IP address constitute personal data within the meaning of the Law, and therefore analytics and advertising cookies are set only after the user has given consent in the cookie notice (Appendix 2). Technically necessary cookies are set without consent, since the website does not function without them.

Service	Purpose	Cookies	Retention period	Provider and country
Tilda Publishing	Website operation, forms, personal account, built-in visit statistics	tildasid, tildauid, previewmode	Up to 1 year	Tilda Publishing, outside the Republic of Kazakhstan
Google Analytics 4 and Google Tag Manager	Visit statistics, traffic sources, behaviour on the website	_ga, _ga_*, _gid, _gat	Up to 2 years	Google Ireland Ltd. and Google LLC, Ireland and USA
Google Ads	Evaluation of the effectiveness of advertising campaigns	_gcl_au	3 months	Google Ireland Ltd. and Google LLC, Ireland and USA
Yandex Metrica	Visit statistics, click maps, session recordings in depersonalised form	_ym_uid, _ym_d, _ym_isad	Up to 1 year	Yandex LLC, Russian Federation
Meta Pixel	Evaluation of advertising campaigns on Facebook and Instagram	_fbp	3 months	Meta Platforms Ireland Ltd. and Meta Platforms Inc., Ireland and USA

7.1. As at the date of approval of the Policy, Google Analytics and Google Tag Manager are connected on the websites automechanika.kz, comtrux.kz and bautrux.kz. Yandex Metrica and Meta Pixel are connected on the websites automechanika.kz and comtrux.kz. The websites bmca.kz, scalex.kz and aerex-expo.kz use only the built-in Tilda statistics. The current list of services is displayed in the cookie notice settings on each website.
7.2. The Operator receives the data of analytics services in aggregated form and does not match them with data from the forms. Service providers may process technical data on servers outside the Republic of Kazakhstan under the terms of their own privacy policies, links to which are provided in the cookie notice.
7.3. The user may withdraw consent to analytics and advertising cookies at any time through the cookie notice settings on the website, and may also delete or block cookies in the browser settings. Refusal of analytics cookies does not restrict access to the website and forms.
7.4. The websites contain links to the Operator's pages on Instagram, Facebook, LinkedIn and YouTube and a button linking to WhatsApp. When these links are followed, the data are processed by the respective platforms. Embedded YouTube videos are loaded only after the user starts the video.
7.5. The websites do not use hidden identification tools (device fingerprints, pixels in emails without notice) and do not transfer visit data to data brokers.
8. Transfer of Personal Data to Third Parties
The Operator transfers personal data to third parties only with the consent of the subject (Article 7(6) of the Law) or in the cases provided for in Article 9 of the Law. Third parties processing data on behalf of the Operator are bound by a contract containing a confidentiality clause and act only within the limits of the Operator's instructions. The Operator does not sell personal data and does not transfer them for the independent marketing purposes of third parties.

Recipient	Which data	For what purpose
Tilda Publishing (website platform)	Data from website forms, personal account data, technical data	Website hosting, receipt and storage of applications, personal account
Registration provider Technolight	Visitor registration data, electronic ticket data, badge scanning data	Online registration, electronic tickets, badge printing and scanning, access control
Selzy (mailing service)	Name, email, subscription topics, email open statistics	Sending informational and advertising mailings, recording of unsubscriptions
Bitrix24 (the Operator's CRM system)	Data of exhibitors, partners and applications, correspondence history	Recording of applications, maintenance of the client database, preparation of contracts
Google Workspace (corporate email and documents)	Business correspondence, event documents	The Operator's work email and document management
Messe Frankfurt GmbH and its subsidiaries (licensor of the Automechanika, Comtrux, Bautrux and SCALEX brands)	Exhibitor data and aggregated visitor statistics	Reporting on licensed events, international assistance to exhibitors
Event exhibitors	Data of a visitor whose badge was scanned at the stand	At the visitor's decision, for subsequent contact
Event organisation partners (EXPO venue, security service, stand construction contractors)	Lists of participants and exhibitor staff to the extent necessary for admission to the venue	Ensuring security and access to the event
Banks and payment organisations	Payment details of exhibitor representatives	Settlements under contracts
State bodies	Data upon a reasoned request	Compliance with the requirements of the laws of the Republic of Kazakhstan

8.1. The list of third parties may change when providers are replaced. The current list is published in this Policy, and the Operator notifies the subject of the transfer of data to a new third party within ten working days if such a condition is included in the consent (Article 19(1) of the Law).
8.2. The confidentiality of the data of exhibitors, partners and visitors with whom the Operator works under a contract is additionally governed by the terms of those contracts.
9. Cross-Border Transfer
The Operator uses services whose servers are located outside the Republic of Kazakhstan, and therefore the processing of part of the personal data involves their cross-border transfer within the meaning of Article 16 of the Law. Such transfer is made to the territory of states that ensure the protection of personal data, and in other cases on the basis of the consent of the subject (subparagraph 1) of paragraph 3 of Article 16 of the Law). Information on cross-border transfer is included in the text of the consent (Appendix 1).

Transfer destination	State	Data
Messe Frankfurt GmbH	Germany (European Union)	Exhibitor data, aggregated statistics
Google (Analytics, Ads, Workspace)	Ireland, USA	Technical data, business correspondence
Meta Platforms (Meta Pixel, WhatsApp, Instagram, Facebook)	Ireland, USA	Technical data, WhatsApp correspondence
Tilda Publishing	State in which the platform's servers are located	Data from forms, personal account
Selzy	State in which the service's servers are located	Name, email of subscribers
Exhibitors and partners from other countries	Country of the exhibitor	Visitor data upon badge scanning, business correspondence

9.1. The Operator concludes contracts with service providers containing obligations to protect personal data and selects providers that offer standard contractual terms or certification under recognised information security standards.
9.2. The subject may withdraw consent to cross-border transfer in accordance with Section 6. In that case, the Operator ceases to use the respective services in relation to the subject's data, which may make it impossible to provide the service (for example, sending a mailing or issuing an electronic ticket).

10. Retention Periods and Place of Storage
The Operator stores personal data in digital objects located in the territory of the Republic of Kazakhstan (Article 12(2) of the Law). The main database of exhibitors, visitors and partners is maintained on the Operator's servers and in the Operator's CRM system located in the Republic of Kazakhstan. The services specified in Section 9 are used for the receipt and transfer of data, after which the data are moved to the Operator's database.

Data category	Retention period	Ground
Contracts with exhibitors, invoices, acceptance certificates and related correspondence	5 years after the end of the year in which the contract was performed	Law of the Republic of Kazakhstan No. 234-III of 28 February 2007 "On Accounting and Financial Reporting", Code of the Republic of Kazakhstan No. 214-VIII of 18 July 2025 "On Taxes and Other Mandatory Payments to the Budget"
Participation applications that did not result in a contract	3 years from the date of the application	Preparation period for the next editions of the event, consent of the subject
Requests via the feedback form	1 year from the date of the reply	Consent of the subject
Visitor registration and electronic ticket data	3 years after the end of the event, then depersonalisation for statistics	Consent of the subject, preparation of the next editions of the event
Subscription to mailings	Until withdrawal of consent	Consent of the subject
Accreditation of journalists, speaker applications	3 years after the end of the event	Consent of the subject
CVs of job applicants	Until the vacancy is closed, with the applicant's consent up to 1 year	Consent of the subject
Personal account on the website	Until the account is deleted by the user or 2 years without login	Consent of the subject
Photo and video materials of events	Indefinitely as part of the event archive	Consent of the subject at registration
Cookies and technical data	In accordance with Section 7, server logs up to 1 year	Consent of the user

10.1. Upon expiry of the retention period, upon achievement of the purpose of processing or upon withdrawal of consent, the Operator destroys the personal data or depersonalises them (Article 18 of the Law). Destruction is confirmed by a certificate.
10.2. Where a mandatory retention period is established by law, a subject's request for deletion is complied with in the form of blocking of the data and cessation of their use until the expiry of that period (Article 41 of the Digital Code of the Republic of Kazakhstan).
11. Personal Data Protection Measures
The Operator takes legal, organisational and technical measures to protect personal data in accordance with Article 22 of the Law and the Rules approved by Order No. 179/НҚ of 12 June 2023 as amended by Order No. 338/НҚ of 22 June 2026.
11.1. Organisational measures. Appointment of a person responsible for organising the processing of personal data. Approval of the list of personal data necessary and sufficient for the Operator's tasks. Inventory of the business processes in which personal data are processed. Familiarisation of employees with personal data legislation and a confidentiality undertaking. Employee access to data only to the extent necessary for their duties.
11.2. Technical measures. Transmission of data via the websites over the HTTPS protocol. Differentiation of access rights and two-factor authentication in the CRM system and corporate email. Backups. Logging and recording of actions with personal data (modification, blocking, destruction). Antivirus protection of workstations.
11.3. Contractual measures. Confidentiality and personal data protection clauses in contracts with service providers, the registration provider, exhibitors and contractors.
11.4. Personal data security breach. Upon detection of a security breach, the Operator notifies the authorised body within one working day, indicating the contact details of the responsible person (subparagraph 8) of paragraph 2 of Article 25 of the Law), and takes measures to minimise the consequences. Subjects whose rights are affected are notified in the manner established by the Rules approved by Order No. 481/НҚ of 9 August 2024.
12. Rights of Personal Data Subjects and Procedure for Handling Requests
The subject exercises the rights provided for in Article 24 of the Law and Article 41 of the Digital Code of the Republic of Kazakhstan by sending a request to the Operator in accordance with clause 3.3 of this Policy. Access to one's own personal data is provided free of charge.

Right of the subject	Content	Time limit for performance by the Operator
To know of the existence of data and to receive information	Confirmation of the fact, purposes, sources and methods of processing, the list of data, the periods of processing and storage	15 working days from the date of receipt of the request
To demand modification and supplementation of data	Where supporting documents are available	1 working day
To demand blocking of data	Where there is information about a breach of the processing conditions	1 working day, blocking until a decision is taken
To demand destruction of data	Where the data were collected in breach of legislation or the purpose of processing has been achieved	1 working day after confirmation of the fact
To demand deletion, anonymisation or restriction of processing	Data processed in the digital environment, except in cases of mandatory retention by law	15 working days
To withdraw consent	To collection, processing, transfer to third parties, cross-border transfer, dissemination	Cessation of processing within 15 working days
To object to automated processing	Where such processing affects the rights of the subject	3 working days for consideration and reply
To refuse mailings	At any time	Removal from the mailing list no later than 5 working days

12.1. The time limits are established by subparagraph 8) of paragraph 2 of Article 25 of the Law, Article 8(7) of the Law, Article 19-1(3) of the Law and the legislation of the Republic of Kazakhstan on the procedure for handling requests.
12.2. The Operator may refuse to comply with a request if it contradicts the laws of the Republic of Kazakhstan, if the data are necessary for the performance of an outstanding obligation or if the identity of the applicant has not been confirmed. A refusal is sent to the applicant in reasoned form within the time limit established for consideration of the request.
12.3. The subject may appeal against the actions or inaction of the Operator to the authorised body (Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, Information Security Committee) and to the court in the manner established by the laws of the Republic of Kazakhstan (Article 30 of the Law).
12.4. The subject may claim compensation for moral and material damage caused by a breach of personal data legislation.
12.5. The subject must provide the Operator with accurate personal data and notify the Operator of any changes to them where this is necessary for the performance of a contract or the provision of a service.
12.6. A representative of an exhibitor, partner or media outlet who provides the Operator with the data of other employees of their organisation confirms that they have obtained the consent of those employees to do so.
12.7. Requests received via WhatsApp or social networks are handled in the same manner, but in order to comply with a request the Operator may ask that the request be sent by email.
12.8. Users from the European Union and the European Economic Area. The legal grounds for processing within the meaning of Article 6 of Regulation (EU) 2016/679 are consent (paragraph 1(a)), performance of a contract with the exhibitor (paragraph 1(b)) and the legitimate interest of the Operator in holding events and conducting business communication (paragraph 1(f)). Such users additionally have the right to data portability, the right to object to processing based on legitimate interest and the right to lodge a complaint with the supervisory authority of the state of their residence. Transfer of data to the Republic of Kazakhstan is carried out on the basis of the consent of the subject and contractual data protection guarantees.
13. Informational and Advertising Mailings
The Operator sends mailings about its events only to persons who have given separate consent to receive mailings, in accordance with the Law of the Republic of Kazakhstan No. 508-II of 19 December 2003 "On Advertising". Mailings are sent via the Selzy service on behalf of the Operator, with the sender indicated and an unsubscribe link in each email.
13.1. Consent to mailings is given when subscribing on the website, when registering for an event or when submitting a participation application, by ticking a separate field. Visitor registration or an exhibitor application without such a tick does not constitute consent to mailings.
13.2. Service messages related to an application or registration (registration confirmation, electronic ticket, change of event dates and venue, reply to a request) are not advertising mailings and are sent without separate consent to mailings.
13.3. Refusal of mailings is effected via the "Unsubscribe" link in an email or by a request to info@bmca.kz. After refusal, the email address is retained on an exclusion list to prevent repeated sending.
13.4. The mailing service records the delivery and opening of an email and clicks on links. The Operator uses these data in aggregated form to evaluate the effectiveness of mailings.
13.5. Mailings via WhatsApp and other messengers are sent only to persons who have previously contacted the Operator themselves through that channel or have consented to that method of communication.
14. Amendments to the Policy and Final Provisions
The Operator may amend the Policy in the event of changes to legislation, to the composition of services or to processing procedures. A new version is published on the Operator's websites with an indication of the date of entry into force and applies from that date. Consents given previously remain valid to the extent that they do not contradict the new version.
14.1. The Operator notifies mailing subscribers and registered users of material changes (new purposes of processing, new recipients of data, new destinations of cross-border transfer) by email no later than ten calendar days before the changes enter into force.
14.2. The current version of the Policy is available at bmca.kz/privacy and via a link at the bottom of each of the Operator's websites. The Policy is published in Russian, Kazakh and English. In the event of a discrepancy between the texts, the Russian text prevails.
14.3. The Policy is the document defining the Operator's policy on the collection, processing and protection of personal data within the meaning of subparagraph 1-1) of paragraph 2 of Article 25 of the Law and has been approved by order of the Operator's director.
14.4. Matters not governed by the Policy are resolved in accordance with the legislation of the Republic of Kazakhstan.
Appendix 1. Consent to the Processing of Personal Data
Consent is given separately when submitting a website form or registering for an event. The consent checkbox is not selected in advance. To submit the form, the user must select the consent checkbox. Consent to receive mailings is optional and is given separately.
Applications, feedback, accreditation and business programme
I consent to Business Media Central Asia LLP collecting and processing my personal data on the terms of the full text of the consent set out below and this Privacy Policy.
Visitor registration
I consent to Business Media Central Asia LLP collecting and processing my personal data for registration for the event and issuance of a personalised badge, and to the transfer of my contact details to the exhibitors whose stands I visit and whose staff I allow to scan my badge, on the terms of the full text of the consent set out below and this Privacy Policy.
Optional consent to mailings
I wish to receive news and offers about BMCA events by email and I consent to the transfer of my name and email address to the mailing service Selzy. I can unsubscribe at any time via the link in the email.
Full text of the consent
I, the personal data subject whose surname, first name and patronymic are indicated in the completed form, consent to Limited Liability Partnership "Business Media Central Asia", BIN 180540003651, address 010000, Republic of Kazakhstan, Astana, Mangilik Yel Avenue, building 53/1 (the "Operator"), collecting and processing my personal data on the following terms.

List of personal data. Surname, first name, patronymic, company, position, country, city, field of activity, email address, telephone number, the content of my request, and any other information that I provide in the form at my own discretion.
Purposes of processing. Consideration of my application or request, preparation of a commercial offer, conclusion and performance of a participation contract, registration for the event, issuance of an electronic ticket and a personalised badge, accreditation, organisation of the business programme, keeping of event statistics.
Actions with the data. Collection, accumulation, storage, modification, supplementation, use, transfer to third parties, cross-border transfer, depersonalisation, blocking and destruction.
Transfer to third parties. The Operator may transfer my data to the website platform Tilda Publishing, the registration provider Technolight, the CRM system Bitrix24, the Google Workspace service, Messe Frankfurt GmbH as the licensor of the event brands, and contractors and partners in the organisation of the event to the extent necessary for admission to the venue, and, when my badge is scanned at a stand, also to the exhibitor whom I have allowed to scan it.
Cross-border transfer. Processing involves the cross-border transfer of data to the territory of Germany, Ireland, the USA and the states in which the servers of the Tilda Publishing and Selzy services are located. I consent to such transfer.
Dissemination in publicly available sources. Not carried out, except for the publication of my name, company and position in the event programme if I am registered as a speaker.
Term of validity of the consent. Until the purposes of processing have been achieved, but no longer than the periods established by Section 10 of the Privacy Policy, or until the consent is withdrawn.
Withdrawal of consent. I may withdraw my consent by sending a request to info@bmca.kz. The Operator ceases processing within fifteen working days, except where processing is necessary for the performance of an outstanding obligation or is expressly provided for by the laws of the Republic of Kazakhstan.
Photo and video recording. I have been notified that reportage photo and video recording takes place at the event, and I consent to the use of materials containing my image in the Operator's reports and press materials.
I confirm that I have read the Operator's Privacy Policy and that the data I have provided are accurate. If I provide the data of other persons, I confirm that I have their consent.

Appendix 2. Cookie Notice and Your Choices
The notice is displayed on the first visit to each website. Until the user makes a choice, only technically necessary cookies are loaded. The choice is saved for 12 months and can be changed via the "Cookie Settings" link at the bottom of the website.
Use of cookies
We use cookies so that the website works correctly, as well as for visit statistics and advertising evaluation. Depending on the website, these services include Google Analytics, Yandex Metrica and Meta Pixel, as described in Section 7. By clicking "Accept all", you consent to the use of all cookies and to the transfer of technical data to the providers of these services outside Kazakhstan.
On websites with optional analytics or advertising cookies, the cookie notice offers the choices "Accept all", "Necessary only" and "Customise". You can accept all cookies, use only technically necessary cookies, or customise your preferences.
Cookie categories

Necessary: Ensure the operation of the website, forms and personal account. Always enabled.
Statistics: Google Analytics, Yandex Metrica and Tilda statistics show us which pages users visit and where they come from. The data are used in aggregated form.
Advertising: Google Ads and Meta Pixel help to evaluate which advertisement brought the user to the website and to show event advertisements to those who have already visited the website.

Websites without third-party analytics
The websites bmca.kz, scalex.kz and aerex-expo.kz use only technically necessary cookies and the built-in statistics of the Tilda platform. Their cookie notice provides a "Got it" button. Further information about the services used on each website is provided in Section 7.