Privacy, Collection, Processing, and Personal Data Protection Policy of the Q1 digital service

1. TERMS AND GENERAL PROVISIONS

1.1. Operator Q1 - Mind technology LLP, BIN 170840015258, address Karaganda, Zhambyl St. 47 n/p1, e-mail support@mindtech.kz, phone +7 708 439 70 98 (hereinafter referred to as “Operator”, “Q1”).

1.2. User — an individual who independently accesses the Q1 web interface, including by scanning a QR code displayed in a restaurant, café, or other establishment.

1.3. Establishment — a legal entity or an individual entrepreneur using Q1 to interact with their visitors.

1.4. Authorized User of the Establishment — an administrator, manager, director, or other employee/representative of a specific Establishment who has been granted login credentials and access rights to the relevant part of Q1.

1.5. The Q1 mobile application is client software developed by the Operator, through which authorized representatives of the Establishment gain access to the Q1 functionality and information related to their Establishment.

1.6. This Policy applies to data processed directly through the Q1 information system.

2. ACTUAL DATA PROCESSING SCHEME

2.1. The User independently scans the QR code displayed at a specific Establishment, after which the Q1 web interface opens on their device.

2.2. For functions involving the entry of information, the User independently and voluntarily completes the relevant form and performs the action of submitting it.

2.3. Upon submission of the form, the information entered by the User is transmitted via the communications network to Q1’s own server infrastructure, physically located within the territory of the Republic of Kazakhstan.

2.4. The Q1 Server receives, processes, and stores the relevant data within the scope of the purposes and timeframes provided for by this Policy, the User’s consent, and the legislation of the Republic of Kazakhstan.

2.5. Following processing by the server, the information necessary to handle the inquiry may be provided—via the Q1 software developed by the Operator—to authorized representatives exclusively of the Establishment to which the inquiry pertains.

2.6. Representatives of one Establishment shall not have access to inquiries and personal data of visitors to another Establishment, except in cases expressly provided for by law or an appropriate legal basis.

3. Q1 FUNCTIONALITY

3.1. Depending on the settings of a specific Establishment, Q1 may enable: summoning a waiter or other staff member; identifying the table or zone; submitting feedback, a complaint, a request, or other communication; providing contact details for follow-up; accessing the digital menu; navigating to Instagram and WhatsApp; accessing Kaspi or Halyk payment tools or other external services; and generating service performance statistics and analytics.

3.2. The core functions of Q1 may be used without User registration.

4. COMPOSITION OF PROCESSED DATA

4.1. Depending on the function being used, the User may voluntarily provide: a name; a mobile phone number; an email address; the text of a review, inquiry, complaint, or suggestion; a service rating; and other information entered by the User into the form.

4.2. Q1 may process information related to the use of the service: the Establishment ID, QR code ID, table or zone number/ID, the date and time of the scan, call, or submission of a request, the action type, the call processing status, and other information necessary for the operation of the relevant function.

4.3. Technical information may be processed to the extent necessary for the operation and protection of the information system: IP address, browser type and version, device type, operating system, session identifiers, event and error logs, and other technical data.

4.4. Q1 does not request PINs, CVV/CVC codes, banking passwords, SMS codes, one-time confirmation codes, or other banking authentication data via the feedback form. The User must not enter such information into Q1 forms.

5. PURPOSES OF PROCESSING

5.1. Data is processed exclusively to the extent necessary for: the functioning of Q1; processing and delivering a call; identifying the relevant Establishment and table/zone; receiving and reviewing inquiries; transmitting an inquiry to the relevant Establishment and its authorized representatives; communicating with the User; reviewing complaints; generating statistics and analytics; monitoring operational quality; diagnosing technical errors; ensuring information security; preventing misuse; and complying with the legal requirements of the Republic of Kazakhstan.

6. GROUNDS AND CONSENT

6.1. Personal data are collected and processed based on grounds provided for by law, including the consent of the personal data subject where such consent is required.

6.2. If function Q1 involves the collection of personal data and applicable law requires consent, the User is given the opportunity to review the processing terms and provide consent through an active action before submitting the relevant form.

6.3. Silence, inaction, or a pre-ticked box are not considered by Q1 as independent confirmation of consent.

6.4. The Operator ensures the ability to confirm the fact that electronic consent has been provided, to the extent required by applicable law.

7. TRANSFER AND ACCESS BY THE ESTABLISHMENT

7.1. A User submitting an inquiry to a specific Establishment is notified that the information necessary to process such an inquiry may become accessible to authorized representatives of that Establishment.

7.2. Depending on the content of the form, such information may include: the content of the inquiry/feedback, a rating, a table/zone identifier, the date and time of the inquiry, and the name, phone number, and e-mail address, if provided by the User.

7.3. Access is granted within the scope of the processing purposes and functional authority of the relevant authorized user of the Institution.

7.4. The Establishment and its representatives are required to use the obtained information solely on lawful grounds and to comply with applicable requirements of the legislation of the Republic of Kazakhstan regarding personal data.

8. Q1 MOBILE APPLICATIONS, APP STORE AND GOOGLE PLAY

8.1. The Q1 mobile applications are developed by the Operator and serve as client software enabling authorized representatives of the Establishment to access the functions of the Q1 information system.

8.2. The Q1 server-side logic and the main database are hosted on the Operator’s own server infrastructure within the territory of the Republic of Kazakhstan.

8.3. Q1 mobile applications are made available on the Apple App Store and Google Play for the purposes of distribution, downloading, installation, and updating.

8.4. The mere fact of making the application available and downloading it via the Apple App Store or Google Play does not constitute a transfer of the Q1 personal data database by the Operator to the operators of the respective app stores.

8.5. Apple, Google, and other platform providers may independently process data generated through the use of their app stores, accounts, operating systems, or other services owned by them. Such independent processing is governed by the terms and policies of the respective providers and does not constitute processing of the Q1 database by the Operator.

8.6. If third-party SDKs, or analytics, diagnostic, push, or other services are incorporated into the Q1 application in the future, resulting in the transfer of personal data or other identifying information to third parties, the Operator shall ensure that the necessary document amendments and other measures required by law are implemented prior to the commencement of the relevant processing.

9. STORAGE LOCATION AND SERVER INFRASTRUCTURE

9.1. The primary Q1 personal data database is stored on the Operator’s own physical server infrastructure, located at the Operator’s office within the territory of the Republic of Kazakhstan.

9.2. The processing of Q1 server-side logic is carried out on infrastructure controlled by the Operator, unless otherwise expressly disclosed to the User and provided for in accordance with applicable law.

9.3. The Operator implements legal, organizational, and technical measures to protect the server infrastructure and the data contained therein.

9.4. Backups of personal data, if created, are subject to the same protection and storage requirements applicable to the corresponding data.

10. CROSS-BORDER TRANSFER

10.1. The Operator does not carry out the cross-border transfer of the primary Q1 personal data database or personal data collected directly via Q1 forms, unless otherwise required by a legal basis and compliance with applicable legislation of the Republic of Kazakhstan.

10.2. In the event of a change in technical architecture, the connection of external services, or the emergence of a need for cross-border transfer, the Operator shall, prior to commencing such processing, ensure compliance with applicable legal requirements, including obtaining separate consent where required.

10.3. A User’s independent navigation to an external link from the Q1 interface does not constitute a transfer of the Q1 personal data database by the Operator to the corresponding external resource.

11. EXTERNAL SERVICES

11.1. Q1 may contain links to Instagram, WhatsApp, a digital menu, the Establishment’s website, Kaspi, Halyk, and other third-party resources.

11.2. Upon redirection to an external resource, the User's data is further processed by the respective service in accordance with its own rules and privacy policy.

11.3. Operator Q1 does not determine the purposes and methods of independent data processing by such external services.

12. PAYMENTS

12.1. Q1 does not accept or process payments and is not a bank, payment institution, or payment system.

12.2. Upon selection of the payment function, Q1 facilitates the technical transition to the payment link, QR code, or other payment instrument provided by the relevant Establishment.

12.3. Q1 is not intended for the collection and storage of bank card details, PIN codes, CVV/CVC codes, banking passwords, SMS codes, or other payment authentication data.

13. ADVERTISING AND MARKETING

13.1. Providing a phone number or e-mail address in the contact form does not constitute consent to receive advertising or marketing communications.

13.2. Contact details may be used to provide a response regarding the relevant inquiry within the scope of the stated purpose.

13.3. The use of data for one’s own advertising purposes is carried out only if there is an appropriate legal basis and, where required, separate consent.

14. Public dissemination

14.1. The User’s personal data shall not be published by Q1 in publicly accessible sources based solely on a request or a withdrawal of consent.

14.2. Publication of a review containing a name, telephone number, e-mail address, or other identifying information is permitted only if there is a separate legal basis and, where required, appropriate consent.

15. STATISTICS AND DISCLOSURE

15.1. Q1 вправе формировать статистические показатели: количество сканирований, вызовов, обращений, время реакции, активность по столам/зонам и показатели использования функций.

15.2. In cases provided for by legislation, anonymization is applied for analytical and statistical purposes.

15.3. Anonymized information is used in such a way that it does not allow for the identification of a specific User without the use of additional information.

16. RETENTION PERIODS

16.1. Personal data shall be stored for no longer than is necessary to achieve the purposes of processing, unless a longer period is prescribed by law or another legal basis.

16.2. Upon the cessation of legal grounds, the data shall be subject to deletion, destruction, anonymization, or other processing as provided for by legislation.

16.3. The Operator periodically assesses the necessity of further data retention based on the purposes of processing and legal requirements.

17. PROTECTIVE MEASURES

17.1. Оператор применяет необходимые и применимые правовые, организационные и технические меры защиты персональных данных.

17.2. Such measures may include defining the list of necessary and sufficient data; segregating access rights; using individual credentials; identification and authentication; logging actions in prescribed cases; protecting data transmission channels; data backup; software updates; protection against malicious software; restricting physical access to server infrastructure; and other measures in accordance with applicable requirements.

17.3. Access to data is granted only to persons who require it to perform their respective functions.

18. UNAUTHORIZED ACCESS AND INCIDENTS

18.1. Upon detection of unauthorized access, loss, or another incident, the Operator shall take measures to halt the violation, establish the circumstances, limit the consequences, and fulfill other obligations prescribed by the legislation of the Republic of Kazakhstan.

18.2. Actions related to the incident are documented to the extent necessary to comply with legal requirements and ensure safety.

19. COOKIES AND TECHNICAL STORAGE

19.1. Q1 may use technical cookies, browser local storage, and similar technologies necessary for interface functionality, security, and session maintenance.

19.2. The implementation of third-party analytics or advertising technologies requiring additional notification or consent shall be carried out only after the relevant legal requirements have been met.

20. USER RIGHTS

20.1. The User possesses the rights of a personal data subject to the extent established by the legislation of the Republic of Kazakhstan, including the right to receive information regarding the processing of their data; to demand the amendment, supplementation, blocking, deletion, or destruction thereof where grounds prescribed by law exist; to withdraw consent; and to protect their rights and appeal to the authorized body and/or a court.

20.2. Rights shall be exercised in the manner established by the legislation of the Republic of Kazakhstan.

21. WITHDRAWAL OF CONSENT AND INQUIRIES

21.1. The User has the right to withdraw previously given consent by submitting a request to the Operator, unless otherwise provided by law.

21.2. The Operator is entitled to request only the information necessary to identify the applicant and the relevant data.

21.3. Upon receipt of a request, the Operator shall act in accordance with the procedures and timeframes established by the legislation of the Republic of Kazakhstan.

21.4. Contact details for inquiries: e-mail support@mindtech.kz; phone +7 708 439 70 98.

22. DATA OF MINORS

22.1. Q1 is not specifically designed for the targeted collection of personal data of minors.

22.2. In cases where legislation requires the consent of a legal representative, the relevant processing is carried out only if the required legal basis exists.

23. CHANGES TO THE POLICY

23.1. The Operator reserves the right to amend the Policy in the event of changes to legislation, Q1 functionality, the scope of data, processing purposes, or technical architecture.

23.2. The current version is posted in the Q1 interface, indicating the date of the version.

23.3. If the change requires obtaining new or additional consent, the relevant processing shall not commence until the applicable requirements have been met.

24. OPERATOR CONTACT DETAILS

Оператор: TOO «Mind technology»

Service: Q1

БИН: 170840015258

Address: Karaganda, Zhambyl st. 47 n/p 1

Email for personal data inquiries: support@mindtech.kz;

Phone: +7 708 439 70 98

25. FINAL PROVISIONS

25.1. The legislation of the Republic of Kazakhstan applies to this Policy.

25.2. If a specific provision of the Policy conflicts with a mandatory provision of law, the corresponding provision of law shall apply, without the automatic invalidity of the remaining provisions.

25.3. The Policy is a publicly available document and is posted in such a way that the User has the opportunity to review it prior to providing personal data.

25.4. The Policy is effective from the date of its approval by the Operator.