PRIVACY POLICY

1. PERSONAL DATA OPERATOR

1.1. The personal data operator is QupC Limited Liability Partnership (LLP) (BIN 260440024360), operating under the trademark qup (hereinafter the “Operator”).

1.2. Contact details of the Operator:

Name

QupC Limited Liability Partnership (LLP)

BIN

260440024360

Registered address

Republic of Kazakhstan, Astana, Esil district, Turkistan street, building 32, apartment 129, postal code 010017

Director

Kuanysh Yelzhan Madiyaruly

Trademark

qup

Website

qupcoffee.kz

Email

hello@qup.coffee

1.3. The Operator is the holder and custodian of Users’ personal data in accordance with the legislation of the Republic of Kazakhstan.

2. TERMS AND DEFINITIONS

• “Personal data” — information relating to a personal data subject who is identified or identifiable on its basis, recorded on an electronic, paper, and/or other tangible medium.
• “Personal data subject” / “User” — a natural person to whom the relevant personal data relate.
• “Operator” — a person authorized to collect, process, and store personal data.
• “Processing of personal data” — any action or set of actions performed with personal data (collection, accumulation, storage, modification, use, distribution, destruction).
• “Service” — the qup software available at qupcoffee.kz.
• “Consent” — a free, informed, and unambiguous expression of will of the personal data subject.
• “Cookies” — small text files placed on the User’s device by the browser or application.

3. CATEGORIES OF DATA COLLECTED

3.1. Data provided directly by the User:

• Name or pseudonym (when specified in the profile or during registration).
• Email address and/or phone number — for notifications about Order status and feedback.
• Payment data (card number, expiry date) — processed exclusively by the Payment Aggregator; the Operator does not store card details.

3.2. Data collected automatically:

• Device location data (GPS/network) — exclusively at the moment of placing and fulfilling an Order to determine the Delivery Point and service area.
• Technical device identifiers (model, OS, browser/application version).
• IP address and Internet service provider data.
• Information about actions in the Service (visit time, pages viewed, Menu items selected, Order history).
• Cookies and similar session identifiers.

3.3. Data from third parties:

• Technical data from the Payment Aggregator required to confirm the success of a transaction (payment status, amount).
• Analytical data from web analytics services in anonymized aggregated form.

4. PURPOSES OF PERSONAL DATA PROCESSING

The Operator processes personal data solely for the following lawful purposes:

• Performance of the contract: receipt, processing, and delivery of Orders; identification of the User and Delivery Point; informing about Order status.
• Ensuring security: prevention of fraudulent transactions; verification of payments; ensuring the technical security of the Service.
• Improving the Service: analysis of user behavior in aggregated form to enhance functionality and the Menu range.
• Fulfillment of statutory obligations: compliance with the requirements of tax, financial, and other applicable legislation; storage of data for the periods established by law.
• Communication with the User: sending notifications about Orders, responses to claims and inquiries.
• Marketing (only with explicit consent): sending informational newsletters about promotions and special offers. The User has the right to withdraw consent to marketing communications at any time.

5. LEGAL GROUNDS FOR PROCESSING

• Performance of the contract (Article 8 of the Law of the Republic of Kazakhstan “On Personal Data”) — processing of data necessary for the receipt and delivery of Orders.
• Consent of the subject — collection of location data, sending of marketing communications.
• Legitimate interests of the Operator — ensuring the security of the Service, preventing fraud, analyzing aggregated statistics.
• Compliance with statutory obligations — storage of financial data for the periods established by tax legislation.

6. PERSONAL DATA RETENTION PERIODS

The Operator stores personal data for the following periods:

• Order data (composition, cost, time) — 5 years from the moment the Order is placed (in accordance with the requirements of tax legislation).
• User contact data — for the duration of the account plus 1 year after its deletion.
• Transaction data — 5 years in accordance with the accounting legislation of the Republic of Kazakhstan.
• Location data — no more than 30 days, after which it is automatically anonymized.
• Technical logs — 90 days.
• Newsletter data — until the User withdraws consent.

Upon expiry of the specified periods, the data is destroyed or anonymized in such a way that its attribution to a specific subject becomes impossible.

7. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

7.1. The Operator does not sell, exchange, or transfer Users’ personal data to third parties, except in the following cases:

• Payment Aggregator — for the processing of payment transactions to the extent necessary to carry out the payment.
• Couriers — the User’s name (or Order identifier) and the Delivery Point for the fulfillment of the Order.
• Cloud service providers — for storing data on secure servers under confidentiality agreements.
• Analytics services — exclusively aggregated, anonymized data.
• Government authorities — upon a lawful request provided for by the legislation of the Republic of Kazakhstan.

7.2. All third parties to whom personal data is transferred are obliged to maintain confidentiality and ensure an appropriate level of protection in accordance with contractual obligations and the requirements of the legislation.

7.3. The Operator does not carry out cross-border transfer of personal data to states that do not ensure an adequate level of personal data protection without obtaining additional explicit consent from the User.

8. RIGHTS OF THE PERSONAL DATA SUBJECT

In accordance with the Law of the Republic of Kazakhstan “On Personal Data and Its Protection,” the User has the following rights:

• Right of access: to obtain information about the list and composition of the personal data being processed and the purposes of its processing.
• Right to rectification: to demand correction of inaccurate or incomplete personal data.
• Right to erasure: to demand deletion of personal data upon expiry of the purpose of processing or upon withdrawal of consent (except for data whose storage is mandatory by law).
• Right to restriction of processing: to demand suspension of the processing of personal data in the cases established by law.
• Right to withdraw consent: to withdraw previously given consent to the processing of personal data without prejudice to the lawfulness of processing carried out before the withdrawal.
• Right to complain: to lodge a complaint with the authorized body for the protection of personal data or with a court.

To exercise these rights, the User sends a request by email to hello@qup.coffee specifying: full name or account identifier; a description of the request; contact details for feedback. The request is reviewed within 15 (fifteen) business days.

9. PROTECTION OF PERSONAL DATA

9.1. The Operator takes technical and organizational measures to protect personal data against unauthorized access, destruction, modification, blocking, copying, and distribution, including:

• encryption of data during transmission via the TLS/HTTPS protocol;
• storage of data on secure servers with restricted access;
• differentiation of employee access rights to personal data;
• regular auditing and monitoring of security systems;
• anonymization and pseudonymization of data where possible;
• use of certified payment services (PCI DSS).

9.2. In the event of a leak or breach of personal data security, the Operator undertakes to notify the affected Users and the authorized bodies within the time limits established by the legislation of the Republic of Kazakhstan.

10. USE OF COOKIES AND ANALYTICS

10.1. The Service uses cookies of the following categories:

• Necessary cookies — mandatory for the functioning of the Service (authorization, cart state, language preferences). Cannot be disabled.
• Functional cookies — remember the User’s preferences to improve the operation of the Service.
• Analytical cookies — collect anonymous statistics about the use of the Service (frequency of visits, popular pages). Used to enhance the Service.

10.2. The User has the right to disable cookies in the browser settings. Disabling necessary cookies may impair the operation of the Service.

10.3. The Operator does not use technologies for tracking Users on third-party websites.

11. DATA OF MINORS

11.1. The Service is not intended for persons under 16 years of age. The Operator does not intentionally collect the personal data of minors.

11.2. If the Operator becomes aware that the personal data of a minor was obtained without the consent of parents or legal representatives, such data is deleted immediately.

11.3. Parents or legal representatives of a minor have the right to contact the Operator to delete their child’s data.

12. AMENDMENTS TO THE PRIVACY POLICY

12.1. The Operator reserves the right to make amendments to this Policy. The current version is posted at qupcoffee.kz with an indication of the date of the last update.

12.2. The Operator notifies Users of changes that materially affect their rights through the Service interface no later than 7 (seven) days before the changes take effect.

12.3. Continued use of the Service after the new version of the Policy takes effect signifies the User’s acceptance of its terms.

13. APPLICABLE LAW AND CONTACT DETAILS

13.1. This Policy has been developed and is applied in accordance with the legislation of the Republic of Kazakhstan, including:

• the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” dated 21.05.2013 No. 94-V;
• the Civil Code of the Republic of Kazakhstan;
• the Law of the Republic of Kazakhstan “On Communications”;
• other applicable legislation.

13.2. On matters related to the processing of personal data, the User has the right to contact:

By email

hello@qup.coffee

On the website

qupcoffee.kz

Subject of inquiry

“Personal data — [your name/account]”