CONSENT TO THE COLLECTION AND PROCESSING OF PERSONAL DATA in the Q1 digital service

1. METHOD FOR INITIATING PROCESSING

1.1. The User scans the QR code displayed in a specific restaurant, café, or other establishment (hereinafter referred to as the "Establishment") on their own, after which the Q1 web interface opens on the User's device.

1.2. The User independently selects the required Q1 function and, if the corresponding function involves the entry of personal data, voluntarily completes the form and submits it.

1.3. Before submitting a form containing personal data, the User is provided with the opportunity to review this Consent and the Q1 Policy on the confidentiality, collection, processing, and protection of personal data.

1.4. Personal data is transmitted to the Operator only after the User performs the corresponding action in the Q1 interface.

2. LIST OF PERSONAL AND OTHER DATA BEING PROCESSED

2.1. Depending on the function used and the information actually provided by the User, the Operator may collect and process: name; mobile phone number; email address; the text of a review, inquiry, suggestion, complaint, or other message; a service quality rating; and other information that the User voluntarily enters into the relevant form.

2.2. In connection with the use of Q1, information necessary for routing and processing the request may also be processed: the Establishment identifier, the unique QR code identifier, the table/zone number or identifier, the date and time of the scan, call, or request submission, the action type, and the processing status.

2.3. Technical data may be processed to the extent necessary for system operation, information security, and the verification of actions performed: IP address, browser type and version, device type, operating system, session identifiers, and information regarding technical errors and information system events.

2.4. Q1 does not request bank card numbers, expiration dates, CVV/CVC codes, PINs, banking passwords, SMS codes, one-time confirmation codes, or other banking authentication data via forms. The User must not enter such information into Q1 forms.

3. PURPOSES OF COLLECTION AND PROCESSING

3.1. The User provides consent to the processing of data exclusively for the following purposes: ensuring the operation of Q1; receiving, processing, and delivering calls to an employee of the relevant Establishment; identifying the Establishment and table/zone; receiving and processing feedback, complaints, requests, or other inquiries; granting the relevant Establishment and its authorized representatives access to information necessary to review the inquiry; providing feedback to the User; resolving dispute situations; generating statistical and analytical indicators, including through data anonymization; diagnosing and troubleshooting technical errors; ensuring information security; preventing abuse and unauthorized access; complying with the requirements of the legislation of the Republic of Kazakhstan.

4. ACTIONS INVOLVING PERSONAL DATA

4.1. Within the scope of the stated purposes, the User consents to the Operator performing necessary actions with personal data, including collection, receipt, recording, systematization, accumulation, storage, updating, modification, supplementation, use, granting access, transfer in cases provided for by this Agreement, blocking, anonymization, deletion, destruction, and other actions permitted by the legislation of the Republic of Kazakhstan and necessary to achieve the stated purposes.

5. DATA TRANSMISSION PATH IN Q1

5.1. Upon the User’s submission of the form, the provided information is transmitted via a communications network directly to the Q1 information system and arrives at the Operator’s own physical server infrastructure located within the territory of the Republic of Kazakhstan.

5.2. Server Q1 processes and routes incoming information in accordance with the function selected by the User and the identifier of the specific Establishment.

5.3. Following server-side processing, the relevant information may become accessible via the Q1 software developed by the Operator to authorized representatives exclusively of the Establishment to which the corresponding call, review, or inquiry pertains.

5.4. Representatives of one Establishment shall not have access to the personal data and inquiries of visitors to another Establishment, except in cases expressly provided for by legislation or other legal grounds.

6. ACCESS BY AUTHORIZED REPRESENTATIVES OF THE ESTABLISHMENT

6.1. The User agrees that the information necessary to process their inquiry may be provided via Q1 to the administrator, manager, director, or other authorized employee/representative of the relevant Establishment.

6.2. Depending on the content of the request, such persons may have access to: the content of the request or feedback; the rating; the table or zone number/identifier; the date and time of the request; the name; the phone number; and the email address—provided that the relevant information was supplied by the User and is necessary for the stated purpose.

6.3. Access is granted within the scope of the functional authority of the relevant authorized user of the Institution and the purposes of processing.

6.4. This Consent does not provide for the disclosure of the User’s personal data to other Establishments not involved in the relevant request.

7. Q1 MOBILE APPLICATIONS

7.1. Q1 mobile applications are developed by the Operator and used as client software through which authorized representatives of the Establishment access the designated functionality of Q1.

7.2. The Q1 server-side logic and the primary database are hosted on the Operator’s own server infrastructure within the territory of the Republic of Kazakhstan.

7.3. Q1 mobile applications may be published and made available for download via the Apple App Store and Google Play. These app stores are used for the distribution, installation, and updating of the software.

7.4. The mere fact of publishing or downloading the Q1 application via the Apple App Store or Google Play does not constitute a transfer of the Q1 personal data database by the Operator to the operators of the respective app stores.

7.5. Apple, Google, and other platform owners may independently process data generated through the use of their app stores, accounts, operating systems, or other services. Such independent processing is carried out by the respective provider in accordance with its own terms and privacy policy.

8. STORAGE LOCATION AND SERVER INFRASTRUCTURE

8.1. The primary Q1 personal data database is stored on the Operator’s own physical server infrastructure, located at the Operator’s office within the Republic of Kazakhstan.

8.2. Server-side processing of the primary Q1 database is carried out on infrastructure under the control of the Operator.

8.3. The Operator takes necessary legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, alteration, copying, dissemination, destruction, loss, and other unlawful actions.

8.4. Access to server infrastructure and personal data is restricted to individuals who require such access to perform their duties and who have been granted the necessary access rights.

8.5. Backup copies, if created, are subject to protection and processing in accordance with applicable requirements of the legislation of the Republic of Kazakhstan.

9. CROSS-BORDER TRANSFER

9.1. Based on this Consent, the Operator does not carry out the cross-border transfer of the primary Q1 personal data database or personal data collected directly via Q1 forms.

9.2. In the event of a change to the Q1 architecture, the connection of external services, or the need to carry out a cross-border transfer, the Operator shall, prior to commencing the relevant processing, ensure compliance with applicable requirements of the legislation of the Republic of Kazakhstan, including obtaining the User's separate consent where such consent is required.

9.3. A User’s independent navigation from Q1 via a link to an external resource does not constitute a transfer of Q1 personal data by the Operator to the corresponding external service.

10. EXTERNAL SERVICES AND PAYMENTS

10.1. Q1 may contain links or buttons redirecting to a digital menu, Instagram, WhatsApp, Kaspi, Halyk, the Establishment’s website, and other external resources.

10.2. Once the User has navigated to an external resource, any further interaction with that resource and the processing of data by the relevant third-party service are governed by that resource's own terms and privacy policy.

10.3. Q1 does not accept or process payments, is not a bank, payment institution, or payment system, and does not act as the recipient of funds when payment is made for the Establishment’s goods or services.

10.4. The payment function in Q1 constitutes a technical redirection to a payment link, QR code, or other payment instrument provided by the relevant Establishment.

11. TECHNICAL PERSONNEL

11.1. The Operator is entitled to engage specialists and other persons for the technical maintenance of the information system, if necessary to ensure the operation of Q1.

11.2. Such persons may access personal data only if there is a legal basis for doing so, to the extent necessary to perform the relevant functions, and in compliance with requirements regarding confidentiality and the protection of personal data.

12. Public dissemination

12.1. By this Consent, the User does not consent to the dissemination of their personal data in publicly accessible sources.

12.2. The submission of a review by the User does not constitute consent to the public disclosure of their name, telephone number, e-mail address, or other identifying information.

12.3. The publication of such information is permitted only if there is a separate legal basis and, where required by law, the User’s separate consent.

13. ADVERTISING AND MARKETING

13.1. This Consent does not constitute consent to receive promotional messages, marketing mailings, promotional calls, or other independent marketing communications.

13.2. The telephone number and e-mail address provided by the User in connection with an inquiry may be used for follow-up communication solely within the scope of the relevant inquiry and the stated purposes.

13.3. The use of data for one’s own advertising or marketing purposes is permitted only if there is a separate legal basis and, where required by law, the User’s separate consent.

14. STATISTICS AND DISCLOSURE

14.1. The User consents to the processing of information for the purpose of generating Q1 statistical and analytical metrics within the scope of the stated purposes.

14.2. In cases provided for by legislation, anonymization is applied when using data for statistical and analytical purposes.

14.3. Depersonalized data may be used to analyze the performance of Q1 and the Establishment, provided that such data does not allow for the identification of a specific User without the use of additional information.

15. STORAGE PERIOD AND VALIDITY PERIOD OF CONSENT

15.1. This Consent is valid from the moment it is provided until the purposes of processing are achieved or until it is withdrawn by the User, unless the legislation of the Republic of Kazakhstan provides a legal basis for further processing.

15.2. Personal data shall be stored for no longer than is necessary to achieve the purposes of their processing, unless a different period is prescribed by the legislation of the Republic of Kazakhstan or another legal basis.

15.3. Upon the cessation of the legal grounds for processing, the data shall be subject to deletion, destruction, anonymization, or other processing in the manner established by the legislation of the Republic of Kazakhstan.

16. WITHDRAWAL OF CONSENT AND USER RIGHTS

16.1. The User has the right to withdraw this Consent by sending a corresponding request to the Operator, unless otherwise provided by the legislation of the Republic of Kazakhstan.

16.2. To consider a request, the Operator is entitled to request only such information as is objectively necessary to identify the requester and the relevant personal data.

16.3. Upon receipt of a withdrawal, the Operator shall cease the relevant processing in the manner and within the timeframes prescribed by the legislation of the Republic of Kazakhstan, except in cases where further processing is permitted or required by law.

16.4. The User is entitled to exercise other rights of a personal data subject provided for by the legislation of the Republic of Kazakhstan, including obtaining information regarding the processing, modification, supplementation, blocking, deletion, or destruction of data, subject to the existence of grounds established by law.

17. ELECTRONIC CONFIRMATION OF CONSENT

17.1. Consent may be provided in electronic form by the User selecting the appropriate checkbox and subsequently clicking the form submission button, or by performing another unambiguous active action provided for by the Q1 interface.

17.2. The consent checkbox is not pre-selected by the Operator and requires an independent action by the User.

17.3. In order to confirm that Consent has been provided, the Operator is entitled to record the date and time the consent was given, the identifier/version of this Consent and the Privacy Policy, the Establishment identifier, the QR code/table identifier, the request identifier, and necessary technical details regarding the event.

17.4. The specified information is used, among other things, to confirm the fact, content, and circumstances of the User’s provision of consent.

18. USER ACKNOWLEDGMENTS

18.1. By providing this Consent, the User confirms that, prior to submitting personal data, they have reviewed this Consent and the current Q1 Privacy Policy; understand the purposes and procedures of processing; understand that a communication addressed to a specific Establishment may, upon receipt by the Q1 server, become accessible to authorized representatives of that specific Establishment; are providing information voluntarily; are providing their own contact details or possess a legal basis for providing the data of another person; and have been informed of the right to withdraw this Consent.

18.2. This Consent applies in conjunction with the current Q1 Privacy Policy regarding the collection, processing, and protection of personal data.

19. OPERATOR CONTACT DETAILS

Оператор: ТОО «Mind technology»

Service: Q1

BIN: 170840015258

Address: Karaganda, Zhambyl st. 47 n/p 1

Email for personal data inquiries: support@mindtech.kz

Phone: +7 708 439 70 98