Privacy Policy

Revision v1

1 General provisions

1.1. The personal data operator is OneBonus LLP, BIN 260640033119, located at: Republic of Kazakhstan, Almaty, Alatau district (the “Operator”).

1.2. The personal data subject is the individual using the Application (the “User”).

1.3. The Policy covers all personal data processed by the Operator in connection with the operation of the Application. It does not cover personal data processed by Partners independently in their own information systems, or by the owners of third-party services and websites that the Application may link to.

1.4. The current version of the Policy is published in the Application and is available to the User before consent to the processing of personal data is given.

2 Categories of personal data processed

2.1. The Operator processes the following personal data provided by the User:

• 2.1.1. the subscriber device number (mobile phone number) used as the identifier at sign-in;
• 2.1.2. the User's name;
• 2.1.3. at the User's discretion — date of birth, e-mail address, an image (profile photo) and the information about themselves given in the profile.

2.2. The Operator processes the following data generated through use of the Application:

• 2.2.1. transaction records: the date and time of confirmed transactions, Stamps awarded, Rewards provided and used, participation in Programmes, and the list of favourite venues;
• 2.2.2. the content of support enquiries and the correspondence about them, including the subject the User selected and the version of the Application;
• 2.2.3. technical information: device model, operating-system type and version, Application version, the device identifier used to deliver push notifications, IP address, and the date and time of sign-ins;
• 2.2.4. device location data — processed only while the feature showing venues on a map is in use, and only where the User has granted permission in their device settings. Location is not collected in the background, and refusing permission does not restrict access to any other feature of the Application.

2.3. The Operator does not collect or process special categories of personal data, including information about racial or ethnic origin, political opinions, religious beliefs or health, or biometric personal data.

3 Purposes of processing personal data

3.1. Personal data is processed for the following purposes:

• 3.1.1. concluding and performing the Terms of Use, registering the User and confirming their sign-in by means of a One-time code;
• 3.1.2. recording the User's participation in Programmes, awarding Stamps, providing Rewards and displaying transaction history;
• 3.1.3. showing Partners' venues, including those near the User;
• 3.1.4. considering the User's enquiries and responding to them;
• 3.1.5. sending service messages and notifications relating to performance of the Terms of Use;
• 3.1.6. sending advertising and marketing messages — where the User has given separate consent;
• 3.1.7. ensuring information security and preventing and detecting bad-faith activity and fraud;
• 3.1.8. improving the functionality of the Application and producing statistical reporting — in anonymised form;
• 3.1.9. meeting the obligations imposed on the Operator by the laws of the Republic of Kazakhstan.

3.2. Personal data is not processed for purposes incompatible with those set out in this section. The Operator does not take decisions producing legal effects for the User solely on the basis of automated processing of personal data.

4 Legal grounds for processing

4.1. The legal grounds for processing personal data are:

• 4.1.1. the consent of the User as the personal data subject, given in the manner set out in the section “Giving and withdrawing consent”;
• 4.1.2. the need to process the data in order to conclude and perform the Terms of Use, to which the User is a party;
• 4.1.3. the cases in which the laws of the Republic of Kazakhstan permit personal data to be processed without the subject's consent.

5 Giving and withdrawing consent

5.1. Consent to the collection and processing of personal data is given by the User in electronic form by an act of implied consent — requesting a One-time code on the Application's sign-in screen. The texts of this Policy and of the Terms of Use are available to the User on the same screen before that act is performed. Consent is deemed given at the moment such a request is sent; the Operator does not begin processing personal data before that moment. Subsequently entering the One-time code confirms that the subscriber device number belongs to the User and does not constitute separate consent.

5.2. Consent is given on the terms of this Policy and covers the following:

• 5.2.1. the operator collecting and processing the personal data — OneBonus LLP, BIN 260640033119, Republic of Kazakhstan, Almaty, Alatau district;
• 5.2.2. the personal data subject — the User, identified by the subscriber device number given at registration and by their profile details;
• 5.2.3. the list of personal data collected — set out in the section “Categories of personal data processed”;
• 5.2.4. the purposes of collection and processing — set out in the section “Purposes of processing personal data”;
• 5.2.5. transfer of personal data to third parties — carried out in the scope and on the terms set out in the section “Transfer of personal data to third parties”;
• 5.2.6. cross-border transfer of personal data — carried out on the terms set out in the section “Cross-border transfer of personal data”;
• 5.2.7. dissemination of personal data in publicly available sources — is not carried out;
• 5.2.8. the term of the consent — for as long as the Account exists and for the retention period set out in the section “Retention periods and destruction of personal data”, or until the User withdraws consent.

5.3. The fact and the moment consent was obtained are evidenced by the Account registration records — the subscriber device number and the date and time of registration — which are kept in the Operator's information system for the term of the consent.

5.4. Consent to receive advertising and marketing messages is given separately, through the corresponding setting in the “Account” section of the Application, and may be withdrawn at any time in the same way. Withdrawing that consent does not affect the ability to use any other feature of the Application.

5.5. The User may withdraw consent to the collection and processing of personal data in full by sending an enquiry to the Operator. Withdrawal of consent brings processing to an end and deletes the Account, except for personal data the Operator is required to process and retain under the laws of the Republic of Kazakhstan. Withdrawal of consent does not apply to processing carried out before the Operator received it.

6 Transfer of personal data to third parties

6.1. The Operator transfers to the Partner running the relevant Programme the User's personal data in the scope needed to run that Programme: name, profile image, date of birth and the information about themselves, where the User has given them, together with records of Stamps, Rewards and transactions under that Programme and the figures derived from them. The User's phone number and details of participation in other Partners' Programmes are not transferred to the Partner.

6.2. The Operator engages third parties (processors) that provide services necessary for the Application to work:

• 6.2.1. telecom operators and messaging service providers — to deliver One-time codes by SMS and WhatsApp;
• 6.2.2. Google LLC — the Firebase Cloud Messaging push notification delivery service (on Android devices, and for notification delivery generally);
• 6.2.3. Apple Inc. — the Apple Push Notification service (on iOS devices);
• 6.2.4. CARTO — the supplier of map imagery (based on OpenStreetMap data): when venues are shown on a map the imagery is loaded from its servers, and the User's device IP address therefore becomes available to it. No information about the User, their Account or their transactions is transferred to that supplier;
• 6.2.5. a cloud infrastructure provider — for hosting the Operator's information system and storing and processing data.

6.3. No third-party web analytics services or advertising trackers are used in the Application. If new parties are engaged and given access to personal data, this section is amended accordingly before any such transfer begins.

6.4. Third parties are engaged under contracts providing that personal data is processed solely for the purposes determined by the Operator, and requiring them to keep the data confidential and protected.

6.5. Personal data is provided to state bodies and officials in the cases, scope and manner provided for by the laws of the Republic of Kazakhstan, on the basis of duly issued requests.

6.6. The Operator does not sell personal data and does not transfer it to third parties for use in their own advertising.

7 Cross-border transfer of personal data

7.1. Some of the services the Operator engages under the section “Transfer of personal data to third parties” are located outside the Republic of Kazakhstan, so processing personal data may involve transferring it across borders.

7.2. Cross-border transfer is carried out to the territory of foreign states that ensure the protection of personal data, in the scope necessary to achieve the purposes set out in the section “Purposes of processing personal data”, and in compliance with the requirements of the laws of the Republic of Kazakhstan.

7.3. By accepting this Policy the User consents to the cross-border transfer of their personal data on the terms set out in this section.

8 Retention periods and destruction of personal data

8.1. Personal data is processed and stored for as long as the User's Account exists.

8.2. Where the Account is deleted or consent is withdrawn, personal data is destroyed or anonymised within 30 (thirty) calendar days of the date the corresponding request is received, except for data whose retention period is set by the laws of the Republic of Kazakhstan. A request to delete the Account is made in the Application: “Profile” → “Account” → “Delete account”.

8.3. Anonymised data that does not allow the User to be identified may be stored and used by the Operator for statistical and analytical purposes without any time limit.

9 Measures to protect personal data

9.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful access, alteration, dissemination and destruction, including:

• 9.1.1. encryption of the data transmission channels between the Application and the Operator's information system;
• 9.1.2. the use of One-time codes and dynamic QR codes with a limited period of validity;
• 9.1.3. separation of staff access rights to personal data and the keeping of access logs;
• 9.1.4. backups and data integrity checks.

9.2. In the event of a personal data breach resulting in unlawful disclosure, the Operator notifies the User and the authorised body in the manner and within the time limits set by the laws of the Republic of Kazakhstan.

10 Rights of the User as a personal data subject

10.1. The User has the right to:

• 10.1.1. obtain information about whether the Operator holds their personal data and about the conditions of access to it;
• 10.1.2. require personal data to be amended or supplemented where there are grounds confirmed by the relevant evidence;
• 10.1.3. require personal data to be blocked where there is evidence that the conditions of its processing have been breached;
• 10.1.4. require the destruction of personal data processed in breach of the laws of the Republic of Kazakhstan, withdraw consent previously given, and delete the Account in the Application;
• 10.1.5. obtain information about the third parties to whom their personal data has been transferred;
• 10.1.6. appeal against the Operator's acts (or failure to act) to the authorised personal data protection body or to a court.

10.2. The User changes their name, date of birth, profile image and contact details themselves in the “Account” section of the Application.

10.3. To exercise any other right the User sends an enquiry through the “Help and support” section or to the e-mail address support@onebonus.app. The enquiry is considered within the time limits set by the laws of the Republic of Kazakhstan.

11 Final provisions

11.1. The Operator may amend this Policy. The new version is published in the Application and takes effect upon publication unless the version itself provides otherwise.

11.2. The Operator gives notice of amendments that materially affect the User's rights through the Application or by push notification.

11.3. Matters not governed by this Policy are resolved in accordance with the laws of the Republic of Kazakhstan.

12 Operator's details

12.1. Name: OneBonus LLP.

12.2. Business identification number (BIN): 260640033119.

12.3. Location: Republic of Kazakhstan, Almaty, Alatau district.

12.4. The Operator's full registered address is held in the National Register of Business Identification Numbers and is provided on request sent to the e-mail address given below.

12.5. Bank details: IIC KZ43601A861088867131 at Halyk Bank of Kazakhstan JSC, BIC HSBKKZKX, KBe 17, account currency KZT.

12.6. E-mail address for enquiries: support@onebonus.app.

12.7. Enquiries are also accepted through the “Help and support” section of the Application.