Privacy policy
This English version is a courtesy translation; only the Kazakh and Russian texts have legal force.
Version of 16 October 2026
This Policy explains what personal data the Qajet mobile app (the "App") collects and why, who receives it, where and for how long it is kept, and how users can control it. It is adopted by Qajet Corporation LLP, BIN 250740031749, address: 160A Raiymbek Avenue, Almaly District, Almaty 050061, Kazakhstan (the "Company"), under Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection" (the "Law").
1. Who processes the data
The Company is the owner and operator of the personal database. Person responsible for organising personal data processing: [responsible person's name], [e-mail]. Questions about data can also go to support: WhatsApp +7 707 710 93 98.
2. What we collect
All users
| Data | Source | Purpose |
|---|---|---|
| Phone number | entered by the user | sign-in, contact between passenger and driver, support |
| Name | entered by the user (optional) | addressing the user, showing to the other party to a trip |
| Role, language, last role used | the App | running the App |
| IP address, device and App version information, request logs | automatically | security, finding faults |
| Screens opened in the App, main buttons pressed, order steps, kinds of errors shown, and their times (no addresses, coordinates or text) | automatically | making the App easier to use, finding where people struggle (product analytics) |
Passengers
| Data | Source | Purpose |
|---|---|---|
| Pickup and destination addresses and coordinates | entered or picked on the map | order, fare, route |
| Device location | with permission, while the App is open | showing the passenger on the map, suggesting the pickup address |
| Order history: time, route, tariff, fare, payment method and status, cancellation reason | the Service | trip history, settlement, complaints |
| Card token, scheme, last 4 digits, expiry | the payment provider | card payment |
| Ratings, tags, comments | entered by the passenger | quality control |
The full card number and CVC are entered only on the payment provider's page and never reach the Company.
Drivers
| Data | Source | Purpose |
|---|---|---|
| Photos of the driving licence and vehicle registration certificate (both sides) | uploaded by the driver | admission check |
| Full name, licence number, categories, issue and expiry dates; car make, model, year, colour, plate, VIN, certificate number, owner's full name | read from the photos or entered by the driver, checked by staff | admission check, showing car details to passengers |
| Location: coordinates, heading, speed | the driver's device every 3–5 seconds during shifts and trips, including in the background | finding the nearest driver, showing the car to the passenger, arrival time, disputes |
| Transfer details: bank, phone, recipient name | entered by the driver | payment by transfer, payouts |
| Balance, transactions, commission, top-ups, payouts | the Service | settlement with the driver |
| Average rating, review status, reasons for refusal or blocking | the Service | quality and safety |
A driver's location is collected only while the driver has chosen to be on shift and until the trip ends. It is not tracked off shift or in the passenger role. A shift ends by itself if no location arrives for 15 minutes.
3. Legal basis
Data is processed with the user's consent (Consent to the collection and processing of personal data) and, without consent, in the cases provided by Article 9 of the Law (for example, at the request of authorised public bodies and to comply with tax law).
4. Who sees the data
- The passenger, once the order is accepted, sees the driver's name, phone, car, average rating and position, and, when paying by transfer, the driver's transfer details.
- The driver, before accepting, sees only the addresses, distance, fare and payment method; after accepting, the passenger's name and phone. The driver never sees who rated them what.
- Company staff access data only as far as their work requires: document review, support, settlement.
- Processors acting for the Company:
- the hosting provider [hosting provider name], with servers in the Republic of Kazakhstan;
- the payment provider [payment provider name] and banks, for linking cards, holds, charges and refunds;
- 2GIS ([2GIS legal entity]), which receives addresses and coordinates of points to search addresses and build routes, without phone number or name; the Company has turned off usage statistics from the App to 2GIS;
- Meta Platforms (WhatsApp Business), for the phone number and sign-in code;
- Anthropic, PBC (Claude API), only for the document photos of drivers who separately agreed to automatic reading.
- Public authorities, in the cases provided by law.
The Company does not sell personal data or share it for advertising.
5. Where data is kept and cross-border transfer
5.1. The personal database is located in the Republic of Kazakhstan.
5.2. Data leaves the Republic of Kazakhstan only:
- to Meta (WhatsApp): the phone number and sign-in code, to deliver the code;
- to Anthropic (USA): a driver's document photos, only with that driver's separate consent; Anthropic does not use them to train models and deletes them within the period set by its commercial terms;
- to 2GIS: addresses and coordinates of points, if its requests are processed outside the Republic of Kazakhstan. [Lawyer: confirm.]
6. Retention
| Data | Retention |
|---|---|
| Sign-in code | up to 3 minutes, as a hash |
| Driver's current position | until the shift ends |
| Driver's location history during a trip | 1 year after the trip |
| Driver's location history on shift outside a trip | 3 months |
| Orders, payments, balance, top-ups, payouts | 5 years after the end of the calendar year of the transaction |
| Account | while it exists and 3 years after deletion |
| Driver's documents | while the driver is admitted and 3 years after the profile is closed; 1 year if refused and not resubmitted |
| Card token | until the card or account is deleted |
| Ratings and comments | while the account exists, then depersonalised |
| Support requests | 3 years |
| Technical logs | [6 months] |
| Activity in the App (product analytics) | 90 days |
7. How we protect data
Connections to the server are encrypted. Document photos are kept in private storage, served only through short-lived links and never written to logs. Sign-in codes are stored as hashes, and phone numbers in logs are masked. The Company never receives card data. Staff access is limited to their duties. The Company reports personal data security breaches to the authorised body within the time set by law.
8. Device permissions
- Location. For passengers, while the App is open, to show them on the map. For drivers, during a shift, including in the background, with a persistent notification that the App is running. A driver who refuses location access cannot go on shift.
- Camera and photos. Only to photograph a driver's documents. HEIC photos may keep metadata, including where the photo was taken; uploading JPEG is recommended.
9. Automated decisions
The Service automatically offers orders to the nearest drivers and automatically ends a shift when the balance is negative or the signal is lost. Decisions to admit, refuse or block a driver are taken by a Company employee, not by an automated system alone. A user can ask through support for a decision to be reviewed by a person.
10. Your rights
You may: find out which of your data is processed and receive a list of it; require your data to be corrected or completed; require data processed in breach of the law to be blocked or destroyed; withdraw consent; delete your account; object to decisions taken solely by automated means; apply to the authorised personal data protection body or a court.
Send requests to support on WhatsApp +7 707 710 93 98 or to [e-mail]. The Company answers within the time set by the Law. On a justified request, data is corrected, blocked or destroyed within one working day, as the Law requires.
11. Deleting your account
You can delete your account in two ways:
- In the App. Passenger: ☰ menu → "Delete account". Driver: the "Profile" tab at the bottom → "Delete account".
- On WhatsApp. Write to support from the number the account is registered with: WhatsApp +7 707 710 93 98.
The ways to delete an account are also described at https://taxi.qajet.online/delete-account.
An account cannot be deleted while it has an unfinished order or, for a driver, until the balance is settled. After deletion, data the Company must keep by law is kept for the periods in section 6; the rest is destroyed or depersonalised.
12. Children
The App is intended for persons aged 18 or over. The Company does not knowingly collect children's data.
13. Changes
A new version is published in the App. The Company announces material changes in advance. If a change requires new consent, the Company will ask for it.
14. Contact
Qajet Corporation LLP, BIN 250740031749, 160A Raiymbek Avenue, Almaly District, Almaty 050061, Kazakhstan, [e-mail]. Support: WhatsApp +7 707 710 93 98.