Consent to the Collection and Processing of Personal Data

This Consent to the Collection and Processing of Personal Data (hereinafter — the “Consent”) is executed in accordance with Article 8 of the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Its Protection” (hereinafter — the “Law No. 94-V”) and constitutes a standalone document, separate from the Terms of Use and other documents of the Platform.

Terms used in the Consent:

Platform / Service — Tezser (mobile application and website).
Company / Operator — ТОО «Tezser», owner of the Platform, БИН 240540001897, г. Алматы.
User — a person using the Platform; roles: Driver and Passenger.
Trip — a shared (carpool) trip along the Driver’s route.
Cost-share — the Passenger’s reimbursement of part of the Driver’s expenses; it is not a “tariff” and is not a “fare” (the Company does not provide carriage services).
Subscription — paid access to the Platform’s extended features (outside of a Trip).

The Consent is given by the User voluntarily and is confirmed by an affirmative action — by ticking a separate, not pre-filled checkbox in the Platform interface upon registration or upon the first activation of the relevant feature. Without providing the Consent, certain features of the Platform may be unavailable.

1. Personal Data Subject and Operator

1.1. The personal data subject (hereinafter — the “Subject”) is the User — a natural person who provides their personal data to the Operator when using the Platform in the role of Driver and (or) Passenger.

1.2. The Operator (owner and operator of the personal data database) is the Company: ТОО «Tezser», БИН 240540001897, г. Алматы. Requests regarding the processing of personal data are submitted through the Platform (including the account deletion feature).

1.3. The processing of personal data is carried out both by the Operator independently and by third parties on the Operator’s behalf (hereinafter — “authorized persons”) within the purposes and scope defined by this Consent.

1.4. By providing the Consent, the Subject confirms that they are a legally capable person who has reached the age of 18+.

2. List of Processed Personal Data

2.1. The Operator processes the following categories of the Subject’s personal data, provided by the Subject or generated during the use of the Platform:

Registration and contact data: mobile phone number; password (in encrypted form); e-mail address and basic profile data when signing in via Google (OAuth); the confirmation code sent via WhatsApp / Telegram.
Identification and verification data: photographs of the Driver, Passenger and vehicle; a selfie image used to confirm identity (biometric personal data); the results of the moderation of such materials.
Trip data: the Driver’s routes, pick-up and drop-off points, data on picking up a Passenger along the route, Trip history.
Geolocation data: the device’s real-time geolocation, processed to match and conduct the Trip.
Correspondence data: the content of the text chat between the Driver and the Passenger within the Platform.
Technical data and device identifiers: the push notification token (FCM), information about the device and application necessary for the functioning of the Service.
Payment data: the data necessary for billing the Subscription (linking a payment card), processed predominantly on the side of a licensed payment service provider (PSP).

2.2. Biometric personal data (the selfie) is processed solely for the purposes of confirming the User’s identity and countering unfair use of the Platform.

2.3. The Operator does not request from the Subject special categories of personal data (on racial and ethnic origin, political views, religious beliefs, state of health, etc.) and asks that they not be posted on the Platform.

3. Purposes of Processing Personal Data

3.1. The processing of personal data is carried out for the following purposes:

registration, identification and authentication of the User (including confirmation of the phone number by code and sign-in via Google);
verification of Users and vehicles (moderation of photographs and selfies) for the purposes of Trip safety and the prevention of abuse;
operation of the shared Trips service: publication of the Driver’s routes, matching and picking up a Passenger along the route, real-time matching and accompaniment of the Trip based on geolocation data;
ensuring communication between the Driver and the Passenger (chat) and sending notifications (push notifications via FCM);
provision and billing of the Subscription and other paid features of the Platform (outside of a Trip);
ensuring information intermediation in “cost-share” settlements between Users via a licensed PSP under the payment agent scheme (see Section 6);
User support, handling of requests and disputes, improving the quality and safety of the Service;
compliance with the requirements of the legislation of the Republic of Kazakhstan and protection of the rights and legitimate interests of the Operator and Users.

3.2. The processing of personal data is not carried out for purposes incompatible with those specified in clause 3.1 without obtaining a separate consent of the Subject, except in cases directly provided for by the legislation of the Republic of Kazakhstan.

4. List of Actions with Personal Data and Methods of Processing

4.1. With respect to the Subject’s personal data, the Operator and authorized persons have the right to carry out the following actions: collection, recording, systematization, accumulation, storage, refinement (updating, modification), retrieval, use, depersonalization, blocking, deletion and destruction.

4.2. The processing of personal data is carried out both with and without the use of automation tools, in the information systems of the Operator and authorized persons.

4.3. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, dissemination, as well as against other unlawful actions.

4.4. Photographs and other images are stored in object storage (S3 / MinIO); personal data is hosted in the Yandex Cloud cloud infrastructure on the territory of the Republic of Kazakhstan (see Section 7).

5.1. The Consent is provided by the Subject for the period: for the duration of the account and for 3 (three) years after its deletion, unless a different period is established by the legislation of the Republic of Kazakhstan.

5.2. The Consent is valid from the moment it is provided (by ticking a separate, not pre-filled checkbox) and until the expiry of the period specified in clause 5.1, or until it is withdrawn by the Subject in the manner provided for in Section 8 of this Consent.

5.3. Upon the expiry of the validity period of the Consent, upon achievement of the processing purposes, or upon withdrawal of the Consent, the personal data is subject to deletion or depersonalization, except in cases where its further storage is required by virtue of the legislation of the Republic of Kazakhstan (in particular, for the purposes of accounting and tax records, dispute resolution and compliance with the requirements of authorized bodies).

5.4. The storage period for certain categories of personal data may be determined by the periods established by the legislation of the Republic of Kazakhstan and, in this part, may exceed the period specified in clause 5.1.

6. Transfer of Personal Data to Third Parties

6.1. The Subject consents to the transfer (provision, entrustment of processing) of their personal data to the following categories of third parties to the extent necessary to achieve the purposes of Section 3:

the licensed payment service provider (PSP) — for billing the Subscription and ensuring “cost-share” settlements between Users under the payment agent scheme;
Meta Platforms (WhatsApp) — for delivering the confirmation code and service messages;
Telegram — for delivering the confirmation code (as an alternative channel);
Google (including OAuth authentication) — for signing in to the Platform and related services;
Google Firebase (FCM) — for delivering push notifications;
the hosting and cloud infrastructure service provider (Yandex Cloud) — for hosting and storing data.

6.2. The transfer of personal data to third parties is carried out on the basis of this Consent and (or) agreements obliging said persons to ensure the confidentiality and protection of personal data at a level no lower than that established by the legislation of the Republic of Kazakhstan.

6.3. The Company does not provide carriage services and does not hold Users’ funds: payment for the Trip (the cost-share) is made directly between Users (in cash or by direct transfer) or via a licensed PSP under the payment agent scheme, without opening a “Company wallet” holding other persons’ funds. The processing of payment data is carried out in accordance with the Law of the Republic of Kazakhstan No. 11-VI “On Payments and Payment Systems” (Article 13 — the payment agent; Articles 42–44 — the issuance of electronic money).

6.4. The Subject is informed that certain third parties (for example, messenger providers and Google) may process data outside the Republic of Kazakhstan within the framework of message delivery and authentication; at the same time, the storage of the personal data of citizens of the Republic of Kazakhstan is ensured on the territory of the Republic of Kazakhstan in the manner set out in Section 7.

7. Localization of Personal Data in the Republic of Kazakhstan

7.1. In accordance with Article 12 of Law No. 94-V, the Operator ensures the collection and storage of the personal data of citizens of the Republic of Kazakhstan using databases physically located on the territory of the Republic of Kazakhstan.

7.2. For localization purposes, the Subjects’ personal data is hosted and stored in the Yandex Cloud cloud infrastructure in the Republic of Kazakhstan, and photographs — in object storage (S3 / MinIO) also located on the territory of the Republic of Kazakhstan.

7.3. Any cross-border transfer of personal data is carried out in compliance with the requirements of the legislation of the Republic of Kazakhstan and does not relieve the Operator of the obligation to initially collect and store data on the territory of the Republic of Kazakhstan.

8.1. The Subject has the right at any time to withdraw this Consent by using the features of the Platform (including the account deletion feature, if such features are provided).

8.2. Withdrawal of the Consent entails the cessation of the processing of personal data by the Operator and authorized persons and the deletion (depersonalization) of personal data, except in cases where processing and storage continue on grounds independent of the Subject’s consent and directly provided for by the legislation of the Republic of Kazakhstan (clause 5.3).

8.3. The Subject is informed and agrees that withdrawal of the Consent makes it impossible to further use the features of the Platform that require the processing of personal data (in particular, registration, verification, participation in Trips, chat, notifications and the Subscription) and may entail the blocking or deletion of the account.

8.4. Withdrawal of the Consent does not apply to processing lawfully carried out before the moment the Operator receives the withdrawal request.

9. Amendment of This Document

9.1. “The Company has the right to unilaterally amend this document at any time. The new revision is published on the Platform at a permanent address and takes effect from the moment of publication, unless a different date is specified therein. The Company notifies Users of material changes no later than 30 days in advance (via the application, e-mail or another available means). Continued use of the Platform after the changes take effect signifies the User’s consent to the new revision. If the User does not agree with the changes, they must cease using the Platform and have the right to delete their account.”

9.2. As regards the processing of personal data, material changes to the purposes, the list of data, or the range of third parties may require obtaining a new consent of the Subject in the manner of Article 8 of Law No. 94-V.

10. Additional Provisions and Limitation of Liability

10.1. Tezser is an information intermediary and is not a carrier or a party to the Trip. The Company is not liable for the actions of Users, the quality and safety of Trips, or the settlements between Users.

10.2. The Service is provided on an “as is” basis, without warranties of uninterrupted operation or fitness for the User’s particular purposes.

10.3. The Company has the right to restrict, suspend or block access to the Platform and (or) the account, as well as to change or discontinue certain features of the Platform at its discretion, with basic notice to the User in cases where this is required by the Law of the Republic of Kazakhstan No. 274-IV “On Consumer Protection”, to the extent not contrary to the legislation of the Republic of Kazakhstan.

10.4. The Company’s liability to the User is limited to the amount of the Subscription fee received from the User for the last paid period (or another minimum limit established by legislation).

10.5. By posting content on the Platform, the User grants the Company a non-exclusive license to use such content to the extent necessary for the functioning of the Service.

10.6. This Consent is governed by the law of the Republic of Kazakhstan. Disputes not resolved through negotiations are considered by the court at the location of the Company, taking into account the mandatory provisions of the Law of the Republic of Kazakhstan No. 274-IV “On Consumer Protection” on the jurisdiction of disputes involving consumers.

10.7. Information and language support of the Platform is provided in the Kazakh and Russian languages with equal visibility in accordance with the Law of the Republic of Kazakhstan No. 151-I “On Languages in the Republic of Kazakhstan”.

10.8. The classification of the Company’s activities and the nature of its relations with Users is determined according to the substance of the relations that develop, in accordance with Article 2 of the Entrepreneurial Code of the Republic of Kazakhstan; the activities of the Platform do not constitute passenger carriage activities.

11. Confirmation of Voluntariness and Informedness

11.1. By ticking a separate, not pre-filled checkbox and (or) by performing another affirmative action provided for by the Platform interface, the Subject confirms that they:

have read this Consent in full and find the text comprehensible;
provide the Consent voluntarily, of their own free will and in their own interest;
have been informed of the purposes, the list of processed data, the actions performed with it, the storage period, the transfer to third parties and the procedure for withdrawing the Consent;
have been notified of their rights as a personal data subject provided for by Law No. 94-V and of the consequences of withdrawing the Consent.

11.2. This Consent is deemed to have been provided as of the date the Subject performs the action specified in clause 11.1.

Date of providing the Consent: 26.06.2026 Operator: ТОО «Tezser», БИН 240540001897, г. Алматы