Early access
← Back home

Privacy Policy

This Privacy Policy (hereinafter — the “Policy”) defines the procedure for collecting, processing, storing and protecting the personal data of Users of the Tezser platform, and also describes the rights of personal data subjects and the procedure for exercising them.

Terms used:

  • Platform / Service — Tezser (the application and the website).
  • Company / Operator — ТОО «Tezser», the owner of the Platform.
  • User — a person who uses the Platform; roles: Driver and Passenger.
  • Ride — a shared (carpool) ride along the Driver’s route.
  • Cost-share — the Passenger’s reimbursement of part of the Driver’s expenses; NOT a “tariff” and NOT a “fare” (the Company does not provide transportation services).
  • Subscription — paid access to the Platform’s extended features (outside the ride).
  • Personal data (PD) — information relating to a personal data subject who is identified or identifiable on its basis, recorded on an electronic and (or) tangible medium.

Use of the Platform means the User’s consent to the terms of this Policy. If the User does not agree with the Policy, the User must stop using the Platform.

1. Operator and contacts

1.1. The Operator (owner) of the Platform and the entity determining the purposes and means of processing personal data is:

  • Name: ТОО «Tezser»
  • BIN: 240540001897
  • Registered address: Almaty, Duldul Street 24
  • E-mail: dzhurunovt@gmail.com
  • Phone: +7 708 093 98 34
  • Personal-data requests: through the Platform (including the account deletion feature)

1.2. Requests related to the processing of personal data are submitted to the Operator through the Platform (including the account deletion feature).

1.3. An authorized representative of the Operator has been appointed responsible for organizing the processing of personal data and for handling requests from personal data subjects. Requests shall be sent in the manner specified in clause 1.2 of this Policy.

1.4. This Policy applies to all personal data processing operations carried out within the operation of the Platform (the application and the website).

2. What personal data is processed

2.1. Depending on the User’s role (Driver or Passenger) and the features used, the Platform may process the following categories of personal data:

  1. Phone number — for registration, account identification and login confirmation.
  2. Name — for displaying the User in the Service and during interaction between the Driver and the Passenger.
  3. Date of birth — to confirm that the User has reached the minimum permitted age of 18+ and for identification purposes.
  4. Email address (e-mail) — including the address obtained when signing in via a Google account.
  5. Geolocation (location data), including real-time location — for matching ride companions and conducting the Ride along the Driver’s route.
  6. Photographs — the Driver’s photo, the Passenger’s photo and the vehicle’s photo, provided for verification and display in the Service.
  7. Biometric data — a selfie provided as part of the verification procedure (selfie verification) with subsequent moderation.
  8. Payment data — payment tokens and the masked card number (the last digits) used for billing the Subscription. The Company does not store the full bank card details and has no access to them; their processing is carried out by a licensed payment service provider (PSP).
  9. Chat messages — text messages exchanged between the Driver and the Passenger within the Service.
  10. Device data and technical data — information about the device, identifiers and the push token for delivering notifications.

2.2. The processing of biometric data (selfie verification) is carried out solely on the basis of the personal data subject’s consent for the purposes of identity verification and ensuring the safety of Users. If a User refuses to provide biometric data, access to certain features of the Platform may be restricted.

2.3. The Platform is not intended for use by persons under the age of 18+. The Operator does not knowingly collect the personal data of such persons.

3.1. Personal data is processed for the following purposes:

  1. Registration and authentication of the User (registration by phone number with code confirmation; sign-in via Google using the OAuth protocol).
  2. Provision of the Platform’s functionality: publication of routes by the Driver, matching a Passenger to the Driver’s route, organizing the Ride.
  3. Verification of Users and vehicles (photos and selfie with moderation) for safety purposes.
  4. Displaying location and conducting the Ride in real time.
  5. Enabling communication between the Driver and the Passenger (chat).
  6. Sending notifications (push notifications via the notification delivery service).
  7. Billing and provision of the Subscription, as well as settlements related to access to the Platform.
  8. Ensuring security, preventing fraud and violations, and supporting Users.
  9. Compliance with the requirements of the legislation of the Republic of Kazakhstan.

3.2. The legal grounds for processing personal data are:

  1. Consent of the personal data subject (Article 8 of the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V), including consent to collection and processing given upon registration and use of the Platform. The consent includes the list of data processed, the purposes of processing, the list of actions, and the validity period of the consent.
  2. Performance of a contract (the User Agreement) with the User; provision of the Platform’s features is impossible without processing data.
  3. Compliance with legal requirements that impose on the Operator an obligation to process data.

3.3. Consent to the processing of personal data executed in accordance with Article 8 of Law No. 94-V is voluntary. Withdrawal of consent is carried out in the manner provided for in Section 7 of this Policy.

4. Transfer of personal data to third parties and engagement of processors

4.1. The Operator has the right to engage third parties (processors) to process personal data on the Operator’s instructions and for the purposes specified by the Operator, provided that such parties ensure an appropriate level of data protection.

4.2. Such third parties include:

  1. A licensed payment service provider (PSP) — for processing Subscription payments and cashless payment of the cost-share for Trips (including the withholding of the Service fee and the distribution of the remaining part of the cost-share to the Driver). The PSP processes card payment details; the Company receives only tokens and the masked card number.
  2. WhatsApp Cloud API / Meta — for delivering confirmation codes (one-time passwords) during registration and login.
  3. Google — for authenticating the User via a Google account (OAuth).
  4. Push notification service (Firebase / FCM) — for delivering push notifications to the User’s device.
  5. Hosting provider Yandex Cloud (Kazakhstan) — for hosting and storing the Platform’s data.

4.3. Confirmation codes during registration and login may be sent via WhatsApp or via Telegram, depending on the Platform’s settings.

4.4. The transfer of personal data to third parties is carried out to the extent necessary to achieve the purposes specified in Section 3 of this Policy. The Operator does not sell Users’ personal data.

4.5. In the event of a cross-border transfer of personal data (if certain processors process data outside the Republic of Kazakhstan), such transfer is carried out provided that the receiving party ensures the protection of personal data and in compliance with the requirements of the legislation of the Republic of Kazakhstan, including the localization requirements (Section 5 of this Policy).

5. Localization of the personal data of citizens of the Republic of Kazakhstan

5.1. In accordance with Article 12 of the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V, the Operator ensures the storage of the personal data of citizens of the Republic of Kazakhstan within the territory of the Republic of Kazakhstan.

5.2. The databases containing Users’ personal data are hosted with the hosting provider Yandex Cloud in data centers located within the territory of the Republic of Kazakhstan. Photographs and other files are stored in object storage (S3/MinIO) located within the territory of the Republic of Kazakhstan.

5.3. The procedure and scope of the permissible cross-border transfer of certain categories of data (for example, the delivery of codes via third-party services, authentication via Google) are subject to verification for compliance with the requirements of Article 12 of Law No. 94-V and the local localization of the primary databases.

6. Storage periods and protection measures

6.1. Personal data is stored for the period necessary to achieve the purposes of processing, as well as for the duration of the account and for 3 (three) years after its deletion, unless another period is established by the legislation of the Republic of Kazakhstan or by the subject’s consent.

6.2. Upon the expiry of the storage period, upon achievement of the purposes of processing, or upon withdrawal of consent (in the absence of other legal grounds for further processing), the personal data is subject to destruction or anonymization in the manner established by the legislation of the Republic of Kazakhstan.

6.3. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, and dissemination, including:

  1. encryption of transmitted data and storage of passwords in a protected form;
  2. differentiation of access rights to data;
  3. storage of full card payment details solely on the side of the licensed PSP;
  4. maintenance of access logs and control over actions taken with the data;
  5. hosting data on infrastructure located within the territory of the Republic of Kazakhstan.

7.1. The personal data subject has the right to:

  1. receive information concerning the processing of their personal data;
  2. demand the amendment and supplementation of their personal data where there are grounds confirmed by relevant information;
  3. demand the blocking of personal data where there is information about a violation in the course of its processing;
  4. demand the destruction of their personal data whose processing is carried out in violation of the legislation, as well as in other cases provided for by law;
  5. withdraw consent to the processing of personal data, except in cases where the processing is necessary by virtue of law;
  6. protect their rights and legitimate interests, including in court.

7.2. To exercise their rights, the personal data subject sends a request to the Operator in the manner specified in clause 1.2 of this Policy. The Operator reviews the request and provides a response within the period established by the legislation of the Republic of Kazakhstan.

7.3. Withdrawal of consent is carried out by sending a corresponding request to the Operator or by deleting the account (Section 8 of this Policy). Upon withdrawal of consent, the Operator ceases the processing of personal data and ensures its destruction (anonymization), except for data whose processing is necessary by virtue of law or for the performance of obligations to the User or for the protection of the Operator’s rights.

8. Account deletion

8.1. The User has the right to delete their account at any time. Account deletion is available:

  1. directly in the application (in the account settings);
  2. via the public web address (URL) for account deletion posted on the Platform’s website, in accordance with the requirements of the application stores.

8.2. Upon account deletion, the User’s personal data is subject to destruction or anonymization, except for data that the Operator is obliged or entitled to store by virtue of the legislation of the Republic of Kazakhstan (including for the purposes of accounting, settlements, dispute resolution and fraud prevention) for the duration of the account and for 3 (three) years after its deletion, unless a different period is established by the legislation of the Republic of Kazakhstan.

8.3. Account deletion does not release the User from previously incurred obligations related to the use of the Platform.

9. Cookies and website analytics (landing page)

9.1. The Platform’s website (landing page) may use cookies and similar technologies to ensure the operation of the website, to remember settings, and to collect anonymized visit statistics.

9.2. The User has the right to configure their browser to refuse or delete cookies. Disabling certain cookies may affect the correct operation of the website.

9.3. Analytical data is used in an anonymized form for the purpose of improving the operation of the Platform and is not aimed at identifying a specific visitor to the website.

10. Changes to the Policy

10.1. The Company has the right to unilaterally amend this document at any time. The new version is published on the Platform at a permanent address and takes effect from the moment of publication, unless a different date is specified therein. The Company notifies Users of material changes no later than 30 days in advance (through the application, by e-mail, or by another available means). Continued use of the Platform after the changes take effect means the User’s consent to the new version. If the User does not agree with the changes, the User must stop using the Platform and has the right to delete the account.

10.2. The current version of the Policy is always available on the Platform at a permanent address.

11. Contacts for requests from personal data subjects

11.1. For all matters related to the processing of personal data, the exercise of the rights of the personal data subject, the withdrawal of consent and the deletion of data, the User may contact the Operator:

  • Name: ТОО «Tezser»
  • BIN: 240540001897
  • Registered address: Almaty, Duldul Street 24
  • E-mail: dzhurunovt@gmail.com
  • Phone: +7 708 093 98 34
  • Personal-data requests: through the Platform (including the account deletion feature)

11.2. Requests are reviewed in the manner and within the time limits established by the legislation of the Republic of Kazakhstan.

12. Status of the Company, limitation of liability and other terms

12.1. Status of an information intermediary. The Tezser platform is an information intermediary and provides Users with the technical means to find ride companions and to organize shared Rides. The Company is not a carrier and is not a party to the Ride. The Company does not provide transportation services, does not carry out dispatching for a fee within the meaning of the Law of the Republic of Kazakhstan “On Road Transport” No. 476-II, and is not liable for the actions of Users, the quality and safety of the Rides, or the settlements between Users.

12.2. Monetary model. The Company does not provide transportation services. For the provision of the Platform’s information-technology services (matching ride companions and arranging the shared Ride), the Company charges a Service fee, the amount of which is indicated on the Platform (as of the date of this version — 15% of the cost-share amount). The Service fee is a payment for the Platform’s services, and not a payment for carriage. The cost-share — the Passenger’s reimbursement of part of the Driver’s expenses — is agreed by the Users and is paid by the Passenger in cash, by direct transfer, or by cashless payment by bank card through the Platform. Cashless payment of the cost-share is carried out through a licensed payment service provider (PSP); with such payment, the Company withholds the Service fee from the cost-share amount, and the remaining part is due to the Driver; the execution and distribution of the payment are ensured by the licensed PSP. The Company is not a bank, does not provide payment services requiring a license, and does not issue electronic money (Articles 42–44 of the Law of the Republic of Kazakhstan “On Payments and Payment Systems” No. 11-VI). The Company’s income is generated through the Service fee and/or the Subscription. Card linking is used for cashless payment of the Subscription and/or the cost-share for Trips (including the withholding of the Service fee).

12.3. Provision of the Service “as is”. The Service is provided on an “as is” basis, without any warranties of uninterrupted and error-free operation or of fitness for the User’s specific purposes, to the extent permitted by law.

12.4. Restriction and suspension of access. The Company has the right to restrict, suspend or block access to the Platform and (or) the account, as well as to change or discontinue certain features of the Platform at its discretion, providing the User with a basic notice in cases where this is required by the Law of the Republic of Kazakhstan “On Protection of Consumer Rights” No. 274-IV, to the extent not contrary to the legislation of the Republic of Kazakhstan.

12.5. Limitation of liability. The Company’s aggregate liability to the User is limited to the amount of the fee received by the Company for the Subscription for the last paid period (or to another minimum limit permitted by law). This limitation does not apply in cases where such a limitation is expressly prohibited by the Law of the Republic of Kazakhstan “On Protection of Consumer Rights” No. 274-IV.

12.6. Content license. By posting content on the Platform, the User grants the Company a non-exclusive, royalty-free license to use such content to the extent necessary for the operation of the Service (storage, display, processing, moderation).

12.7. Governing law and jurisdiction. The law of the Republic of Kazakhstan applies to the relations between the Company and the User. Disputes are subject to resolution in the court at the Company’s location, subject to the mandatory provisions of the Law of the Republic of Kazakhstan “On Protection of Consumer Rights” No. 274-IV regarding the jurisdiction of disputes involving consumers.

12.8. Language. The document is published in the Kazakh and Russian languages with equal visibility in accordance with the Law of the Republic of Kazakhstan “On Languages in the Republic of Kazakhstan” No. 151-I. In the event of discrepancies between the versions, priority is determined in the manner established by law.