Consent to the Collection and Processing of Biometric Data

Version 1.1 · In force since 2026-08-30 · revision 2d21f4076382

This Consent to the Collection and Processing of Biometric Data (hereinafter — the “Consent”) is a separate, standalone document. It does not form part of the Terms of Use, the Privacy Policy, or any other documents of the Platform, and is provided by the User in addition to them. A refusal to provide this Consent does not entail automatic agreement with any other documents, and vice versa.

This Consent is provided in accordance with the subparagraphs and Article 8 of the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V (the content of the consent of the personal data subject).

1. Subject and Operator

1.1. The personal data subject (hereinafter — the “User” or the “Subject”) is a natural person who uses the Tezser platform (the application and the website; hereinafter — the “Platform” or the “Service”) in the role of a Driver or a Passenger and who provides this Consent.

1.2. The Operator (hereinafter — the “Company” or the “Operator”) is ТОО «Tezser», BIN 240540001897, registered address: г. Алматы, the owner of the Tezser Platform.

1.3. The terms of this Consent are used with the following meanings:

Platform / Service — Tezser (the application and the website).
Company / Operator — ТОО «Tezser», the owner of the Platform.
User — a person who uses the Platform; roles: Driver and Passenger.
Trip — a shared (ride-along) trip along the Driver’s route.
Cost-share — the Passenger’s reimbursement of part of the Driver’s costs; NOT a “fare” and NOT a “fee for carriage” (the Company does not provide carriage services).
Subscription — paid access to the Platform’s extended features (outside the trip).

1.4. This Consent is provided by a User who has reached the age of 18+ years. A person who has not reached the said age is not entitled to provide this Consent or to use the Platform’s features that require biometric verification.

1.5. The biometric data of citizens of the Republic of Kazakhstan is stored and processed within the territory of the Republic of Kazakhstan in accordance with Article 12 of the Law “On Personal Data and Its Protection” No. 94-V (localization of personal data of RK citizens).

2. What Constitutes Biometric Data

2.1. For the purposes of this Consent, biometric data means data characterizing the physiological features of the User, on the basis of which their identity may be established, namely:

the image (photograph) of the User’s face — a selfie taken during the verification process;
technical characteristics derived from the facial image and used for matching (where such characteristics are generated).

2.2. Biometric data is collected solely to confirm the User’s identity (verification): when undergoing the check, the User takes a selfie, which is matched against other images provided by the User and undergoes moderation.

2.3. In addition to the selfie, as part of verification the User may provide photographs (of the Driver / the Passenger / the vehicle), which in themselves are used to confirm identity and information about the vehicle. Providing these photographs is voluntary, except in the case of a targeted request by the Company (clause 6.3). It is specifically the facial image (the selfie) that is subjected to biometric processing within the meaning of this Consent.

2.4. The Company does not use biometric data for purposes not expressly specified in Section 3 of this Consent (in particular — it does not use it for advertising profiling or for transfer for advertising purposes).

3. Purpose of Processing

3.1. Biometric data is processed by the Company solely for the following purposes:

confirmation of the User’s identity (verification) — matching the selfie against the User’s other images and moderation;
ensuring the security of Users and the Platform — reducing the risks of using other persons’ or fake accounts, countering fraud and bad-faith conduct;
maintaining trust between the Driver and the Passenger within the framework of shared Trips.

3.2. Biometric verification is aimed at the security of shared (ride-along) Trips. At the same time, the Company remains an information intermediary and is neither a carrier nor a party to the Trip; verification does not mean that the Company guarantees the quality or safety of any particular Trip (see Section 8).

3.3. The processing of biometric data is carried out to the extent necessary and sufficient to achieve the said purposes and ceases upon their achievement or upon expiry of the storage period (Section 4).

4. Storage Period and Procedure for Destruction

4.1. Biometric data (the selfie) is stored for the following period: for the duration of the account and for 3 (three) years after its deletion, unless a different period is established by the legislation of the Republic of Kazakhstan.

4.2. Upon expiry of the storage period, as well as upon achievement of the processing purposes, withdrawal of this Consent (Section 6), or deletion of the account, the biometric data is subject to destruction in the manner established by the legislation of the Republic of Kazakhstan and the Company’s internal procedures.

4.3. Destruction is carried out by means that preclude subsequent recovery and matching of the data. The fact of destruction is recorded by the Company.

4.4. Biometric data is stored in infrastructure located within the territory of the Republic of Kazakhstan (Yandex Cloud, Kazakhstan); image files are stored in object storage (S3/MinIO). This ensures compliance with the localization requirement under Article 12 of Law No. 94-V.

4.5. Certain information (for example, the fact and result of passing verification, without storing the image itself) may be retained longer where this is necessary to comply with legal requirements, resolve disputes, and protect the Company’s rights — to the minimum necessary extent.

5. Transfer to Third Parties

5.1. The Company is entitled to engage third parties (processors) in the processing of biometric data solely to achieve the purposes of Section 3, in particular:

a provider of cloud infrastructure and object storage (storing images within the territory of the RK);
image moderation/verification services (where applicable).

5.2. The engaged processors act on the Company’s instructions, within the limits of the purposes of this Consent, and are obliged to ensure the confidentiality and protection of data at a level no lower than that established by the Company and the legislation of the RK.

5.3. The Company does not transfer biometric data to third parties for advertising or marketing purposes and does not sell it.

5.4. The transfer of biometric data to state authorities is carried out only in the cases and in the manner expressly provided for by the legislation of the Republic of Kazakhstan (for example, upon a lawful request from an authorized body).

5.5. Cross-border transfer of the biometric data of RK citizens is not carried out in violation of the localization requirements (Article 12 of Law No. 94-V).

6.1. The User is entitled to withdraw this Consent at any time by sending the relevant request through the Platform, or by initiating the deletion of the account.

6.2. Upon receipt of the withdrawal, the Company ceases the processing of biometric data and ensures its destruction in the manner set out in Section 4, with the exception of information whose storage is necessary by virtue of law or to protect the Company’s rights (Section 4.5).

6.3. Consequences of withdrawal. Biometric verification is voluntary and, as a general rule, is not a condition for access to the Platform’s features. The Company is entitled to send the User a targeted request to undergo verification — for the purposes of the security of shared Trips, verifying the accuracy of the information provided, or handling another User’s complaint. In such a case the Company states the reason for the request and the period for complying with it (no less than 7 (seven) calendar days). Withdrawal of Consent, or failure to comply with a targeted request within the stated period, means that the Company is entitled to restrict the provision of features requiring a confirmed identity until the request is complied with. Withdrawal of Consent does not in itself entail blocking of the account.

6.4. Withdrawal of Consent does not affect the lawfulness of the processing carried out prior to the moment of withdrawal.

7. Explicit, Separate Acceptance; Date

7.1. This Consent is provided through an explicit, separate, and non-prefilled action of the User (a separate tick/click that is not combined with the acceptance of other documents and is not pre-set).

7.2. The User confirms that they:

have familiarized themselves with this Consent in full and accept it freely, of their own will and in their own interest;
understand exactly what data (the facial image / the selfie) and for what purposes is being processed;
provide the Consent separately from the Terms of Use, the Privacy Policy, and other documents of the Platform.

7.3. The date of provision of the Consent is deemed to be the date of performing the acceptance, recorded by the Platform: 26.06.2026.

7.4. The acceptance of this Consent is separated from the acceptance of any other documents of the Platform; unticking other documents does not withdraw this Consent, and vice versa.

8. Protective Provisions and Status of the Company

8.1. Tezser is an information intermediary, not a carrier and not a party to the Trip. The Company is not liable for the actions of Users, the quality and safety of Trips, or for settlements between Users. Passing biometric verification does not constitute a guarantee by the Company in respect of any particular User or Trip.

8.2. The Service, including the verification feature, is provided on an “as is” basis, without warranties of uninterrupted operation, freedom from errors, or fitness for the User’s particular purposes.

8.3. The Company is entitled to restrict, suspend, or block access/the account and to modify or discontinue features (including the verification features) at its own discretion, with basic notice to the User in cases where this is required by the Law “On Protection of Consumer Rights” No. 274-IV, to the extent not contrary to the legislation of the Republic of Kazakhstan.

8.4. The Company’s liability associated with the processing under this Consent is limited to the amount of the fee received from the User for the Subscription for the last billing period (or another minimum limit permitted by law).

8.5. With respect to the content posted by the User, the User grants the Company a non-exclusive license to use it within the limits necessary for the operation of the Service.

8.6. Money. The Company does not provide carriage services. Only a Cost-share is possible between Users, and it is due to the Driver in full; for the Platform’s information-technology services the Company charges the Passenger a Service fee in addition to the Cost-share, the amount of which is indicated on the Platform. Payment is made in cash, by direct transfer, or by cashless payment through a licensed payment service (PSP). The Company is not a bank, does not provide payment services requiring a license, and does not carry out the issuance of electronic money (Law “On Payments and Payment Systems” No. 11-VI, Articles 42–44).

8.7. Governing law and disputes. The law of the Republic of Kazakhstan applies to this Consent. Disputes are considered in the court at the location of the Company — subject to the mandatory provisions of the Law “On Protection of Consumer Rights” No. 274-IV concerning jurisdiction for consumers.

8.8. The legal qualification of the relationship is determined by its substance (Article 2 of the Entrepreneurial Code of the RK); the status of a “taxi-hailing application” in the case of paid dispatching is governed by the Law “On Road Transport” No. 476-II. The Platform’s documents are published in the Kazakh and Russian languages with equal visibility (the Law “On Languages in the Republic of Kazakhstan” No. 151-I).

9. Amendment of the Document

9.1. The Company is entitled to amend this document unilaterally at any time. The new revision is published on the Platform at a permanent address and enters into force from the moment of publication, unless another date is specified therein. The Company notifies Users of material changes no later than 30 days in advance (through the application, e-mail, or another available means). Continued use of the Platform after the changes enter into force constitutes the User’s agreement with the new revision. If the User does not agree with the changes, they are obliged to cease using the Platform and are entitled to delete their account.

9.2. With respect to biometric data, material changes to the purposes or procedure of processing that require new consent under Law No. 94-V are formalized by obtaining the User’s new separate consent; until it is provided, processing for the changed purposes is not carried out.