Consent to the collection and processing of personal data
This English version is a courtesy translation; only the Kazakh and Russian texts have legal force.
Version of 16 October 2026
I, a user of the Qajet mobile app (the "App"), under Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection" (the "Law"), freely and in my own interest give this consent to Qajet Corporation LLP, BIN 250740031749, address: 160A Raiymbek Avenue, Almaly District, Almaty 050061, Kazakhstan (the "Company"), as owner and operator of the database holding my personal data, on the terms below.
1. How consent is given
1.1. Consent is given electronically: by tapping the sign-in or registration button in the App after reading this text, and, for drivers, also by ticking "I consent to the processing of my personal data" when submitting documents. The Company keeps a record of the date and time of consent, the phone number and the version of the text.
1.2. Consent to the cross-border transfer of a driver's documents for automatic reading (clause 7.3) is given separately and is not a condition of using the App.
2. Purposes
My personal data is processed to:
- register me and confirm sign-in by phone number;
- accept and pass on taxi orders, and show each party to a trip information about the other and the car's position;
- calculate fares, accept and record payment in cash, by transfer and by bank card, and keep the driver's balance, commission, top-ups and payouts;
- check a driver's documents and admit the driver to receive orders;
- collect ratings and reviews and monitor quality and safety;
- answer support requests and handle disputes and complaints;
- meet the Company's obligations under the law of the Republic of Kazakhstan (including tax, transport and accounting law) and answer lawful requests from public authorities;
- keep the App secure and working and prevent fraud.
3. Personal data covered
All users: mobile phone number; name (if given); chosen role (passenger or driver); App language; technical data (session identifiers, IP address, device and App version information, server request logs).
Passengers: addresses and coordinates of pickup and destination; order history (time, route, tariff, fare, payment method, status, cancellation reason); linked bank card data in the form of the payment provider's token, card scheme, last four digits and expiry date (the Company never receives the full card number or CVC); ratings, chosen tags and comments; the device's coordinates when the passenger picks the pickup point on the map.
Drivers: photos of both sides of the driving licence and the vehicle registration certificate; the data on them: full name, licence number, categories, issue and expiry dates; car make, model, year, colour, registration plate, VIN, certificate number, the car owner's full name; location (coordinates, heading, speed) during shifts and trips, including while the App runs in the background; transfer details (bank, phone number, recipient name as "first name and surname initial"); balance transactions, top-ups, payouts, commission; average rating, review status, reasons for refusal or blocking.
4. Operations
Collection, recording, organisation, accumulation, storage, updating and modification, use, transfer (provision, access) in the cases listed in section 6, depersonalisation, blocking, deletion and destruction, with and without automation.
5. Where data is stored
Personal data is stored in a database located in the Republic of Kazakhstan (servers of the hosting provider [hosting provider name] in the Republic of Kazakhstan), as Article 12(2) of the Law requires.
6. Who receives the data
6.1. The other party to the trip. From the moment a driver accepts the order until the trip ends, the passenger sees the driver's name, phone number, car make, model, colour and plate, average rating and the car's position on the map, and, when paying by transfer, the driver's transfer details. The driver sees the passenger's name, phone number, pickup and destination. Before accepting, the driver sees only the addresses, distance, fare and payment method. The driver never sees which passenger gave which rating.
6.2. Processors acting for the Company: the hosting provider in the Republic of Kazakhstan; the payment provider [payment provider name] and banks, to link cards and take payments; the 2GIS map service ([2GIS legal entity]), which receives addresses and coordinates to search addresses and build routes; Meta Platforms (WhatsApp Business), which receives the phone number and one-time sign-in code.
6.3. Public authorities, in the cases and manner provided by the law of the Republic of Kazakhstan, including the registers kept under transport and platform-employment law, and tax authorities.
6.4. This consent does not allow my personal data to be made public.
7. Cross-border transfer
7.1. Sign-in code. To deliver the code, the phone number and code are passed to Meta's WhatsApp Business service, whose servers are outside the Republic of Kazakhstan (including in the USA and the European Union). By giving this consent I agree to that transfer. Without it, signing in to the App is currently not possible.
7.2. Maps. If the 2GIS servers that handle requests are outside the Republic of Kazakhstan, the addresses and coordinates of route points are transferred abroad. [Lawyer: confirm where 2GIS processes requests.]
7.3. Automatic document reading (drivers only, optional). If I separately tick consent to automatic reading, photos of my driving licence and vehicle registration certificate are sent through the Claude API to Anthropic, PBC (USA), so that the service reads the data listed in section 3. Anthropic processes them only to answer that request, does not use them to train models, and deletes them within the period set by its commercial terms. I check and correct the data read myself, and a Company employee then compares it with the photos; admission is never decided automatically. If I do not give this consent, I fill in the data by hand and the photos are not transferred outside the Republic of Kazakhstan.
8. Retention
Data is kept no longer than the purposes require and the law prescribes:
| Data | Retention |
|---|---|
| Sign-in code | up to 3 minutes (while valid), stored as a hash |
| Driver's current position | until the shift ends (in memory) |
| Driver's location history during a trip | 1 year after the trip |
| Driver's location history on shift outside a trip | 3 months |
| Orders, payments, balance transactions, top-ups and payouts | 5 years after the end of the calendar year of the transaction |
| Account (phone, name, role) | while the account exists and 3 years after it is deleted |
| Driver's document photos and data | while the driver is admitted and 3 years after the profile is closed; 1 year if refused and not resubmitted |
| Bank card token | until the card or account is deleted |
| Ratings, tags and comments | while the account exists; afterwards in depersonalised form |
| Support requests | 3 years |
| Technical logs | [6 months] |
When the period ends, data is destroyed or depersonalised unless the law requires otherwise.
9. Term and withdrawal
9.1. Consent is valid until the purposes are achieved or until it is withdrawn.
9.2. Consent may be withdrawn in full, or only for the cross-border transfer in clause 7.3, by writing to support on WhatsApp at +7 707 710 93 98, to [e-mail], or by letter to 160A Raiymbek Avenue, Almaly District, Almaty 050061, Kazakhstan.
9.3. After withdrawal the Company stops processing and deletes the data, except data it must keep by law and data needed to perform an outstanding obligation (Article 8(2) of the Law), for example until a driver's balance is settled or a trip dispute is resolved. Withdrawing consent for data without which the App cannot work (phone number, a driver's position on shift) means ceasing to use the App and deleting the account.
10. My rights
I understand that under Article 24 of the Law I may: know whether the Company holds my personal data and be told the purposes, methods and periods of processing and who receives it; require my data to be changed or completed; require data processed in breach of the law to be blocked and destroyed; withdraw consent; object to decisions based solely on automated processing; complain about the Company to the authorised personal data protection body or a court and claim damages.
11. Contact
Qajet Corporation LLP, BIN 250740031749, 160A Raiymbek Avenue, Almaly District, Almaty 050061, Kazakhstan. Person responsible for organising personal data processing: [responsible person's name], [e-mail]. Support: WhatsApp +7 707 710 93 98.