1. Who controls your data
Cyan LLC, registered in Astana, Kazakhstan, is the controller of personal data collected through this website and in the course of providing our services. Contact us at [email protected].
We process personal data in accordance with the Law of the Republic of Kazakhstan on Personal Data and its Protection. Where we process data of individuals in the European Economic Area or the United Kingdom, we apply the standards of the General Data Protection Regulation to that processing.
2. What we collect
When you contact us
Your name, email address, company name, the country your borrowers are in, and whatever you choose to write in the message. You provide this voluntarily; if you leave it out we may not be able to answer.
When you visit
Our hosting provider records standard server logs: IP address, date and time, pages requested, referring page and browser type. These are used for security and to keep the site working.
This site sets no cookies and runs no analytics or advertising trackers. Typefaces are loaded from Google Fonts, which means your browser makes a request to Google's servers and Google receives your IP address as part of that request. If that concerns you, a browser extension that blocks third-party font loading will prevent it, and the site will still function.
When you become a client
Providing our services requires more. Depending on the engagement this can include identity documents, proof of address, date and place of birth, nationality and tax residence, details of beneficial ownership and control, information about the source of your funds and wealth, bank details, and correspondence.
3. Why we process it, and on what basis
| Purpose | Basis | Retention |
|---|---|---|
| Answering an enquiry | Steps at your request prior to a contract; our legitimate interest in responding | 24 months from last contact, unless you become a client |
| Providing the services | Performance of our engagement letter with you | Duration of the engagement |
| Identity, beneficial ownership and source-of-funds checks | Compliance with legal obligations | At least 5 years after the relationship ends, as anti-money-laundering law requires |
| Accounting, invoicing and tax records | Compliance with legal obligations | As required by Kazakh tax and accounting law |
| Site security and availability | Our legitimate interest in operating the site safely | Server logs, up to 12 months |
| Establishing or defending legal claims | Our legitimate interest | Until the relevant limitation period expires |
We do not sell personal data, we do not share it for advertising, and we do not use it for automated decision-making that produces legal effects.
4. Who we share it with
Only where it is needed to do the work or where the law requires it:
- Regulators, including the Astana Financial Services Authority, as part of a licence application or ongoing supervision.
- Law firms, auditors and compliance providers engaged on your matter.
- Banks and financial institutions conducting their own onboarding checks.
- Registries and government bodies where filings require it. Some company information, including directors and shareholders, becomes a matter of public record on registration.
- Our service providers, such as hosting, email and document storage, acting on our instructions.
- Law enforcement or courts, where we are legally obliged to disclose.
5. International transfers
Our work is cross-border by nature, so your data may be transferred outside Kazakhstan, including to service providers, counsel and regulators in the United Arab Emirates, Singapore, Hong Kong, the European Union and the jurisdiction where your borrowers are located. Where we transfer data from the EEA or the UK, we rely on appropriate safeguards, which for most transfers means the European Commission's standard contractual clauses.
6. Your rights
Subject to the law that applies to you, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete data, where we have no legal obligation or legitimate ground to keep it;
- restrict or object to processing based on our legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent, where processing relies on consent, without affecting what was done before.
Write to [email protected]. We will respond within 30 days and may need to verify who you are first.
One limit worth stating plainly: we cannot delete records we are required by anti-money-laundering, tax or company law to retain, and we cannot withdraw information already filed with a regulator or registry. If you ask us to delete data during an engagement, we may have to end the engagement instead.
You may also complain to the supervisory authority in Kazakhstan or, if you are in the EEA or the UK, to your local data protection authority.
7. How we protect it
Access is limited to people who need it. Data in transit is encrypted, and identity documents are held in access-controlled storage. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data and presents a real risk to you, we will notify you and the relevant authority as the law requires.
8. Children
This site and our services are for businesses and professional investors. We do not knowingly collect data about anyone under 18.
9. Changes
We may update this policy by posting a new version here with a new date. If a change materially affects how we handle data we already hold about you, we will tell you directly.
10. Contact
Cyan LLC, Astana, Kazakhstan
[email protected]