Privacy Policy

1. General provisions

1.1. This Privacy and Personal Data Processing Policy (the “Policy”) sets out how the personal data of users of the QURYLYS HUB mobile application (the “Platform”) is collected, processed, used, stored, protected and deleted.

1.2. The personal data operator is PRIVATE COMPANY AITIZ LTD (“AITIZ”, the “Operator”).

1.3. This Policy has been drawn up having regard to the law of the Republic of Kazakhstan on personal data and its protection.

1.4. The Policy covers the information the User provides themselves, and also the technical data generated automatically when the Platform is used.

1.5. This Policy applies to the processing of data regardless of how it was obtained, unless the law of the Republic of Kazakhstan expressly provides otherwise.

1.6. By using the Platform, the User confirms that they have read this Policy in the manner provided by the Platform interface and by the rules of its use in force.

1.7. If the User does not agree with this Policy, they must stop using the Platform.

2. Principles of data processing

2.1. AITIZ processes personal data on lawful and fair grounds.

2.2. The amount of data collected is limited to what is necessary for the Platform to function, for security, for providing the features offered, for restoring access, for recording arrangements between Users and for other lawful purposes.

2.3. AITIZ does not collect personal data merely “for the future” where its processing is not required for a specific purpose.

2.4. AITIZ takes reasonable organisational and technical measures to protect personal data against unlawful access, alteration, disclosure, destruction and other unlawful acts.

2.5. Access by AITIZ staff to personal data is limited to what they need in order to perform their duties.

3. What data is collected

3.1. Data provided at registration

When creating an account the User provides:

• a login name;
• a password;
• an email address.

3.1.1. AITIZ does not store the password in plain text. It is stored using cryptographic hashing with a salt.

3.1.2. The email address is used, in particular, to restore access to the account.

3.2. Profile data

The User may voluntarily provide:

• first name;
• last name;
• phone number;
• city;
• district;
• a profile photo;
• a description;
• a specialisation;
• experience;
• a minimum price and other information provided for by the Platform interface.

3.2.1. That information, except for hidden technical data, may be shown to other Users in accordance with the functionality of the Platform.

3.2.2. The phone number is not a mandatory field.

3.2.3. The phone number is not shown to other Users through the Platform.

3.2.4. The User’s email address is not shown to other Users.

4. Data about organisations

4.1. The Platform may process information about organisations whose profiles are created by the AITIZ team.

4.2. Such information includes:

• the name of the organisation;
• the BIN;
• the address;
• the size of the team;
• the logo;
• other information published in the organisation profile.

4.3. Organisations do not create their own accounts through the standard registration form for individuals.

4.4. A User cannot give their own account the status of “Supplier” or “Company”.

5. Request data

5.1. When creating a request the User may provide:

• a description of the work required;
• the address of the site;
• photographs;
• a budget;
• timing;
• other information provided for by the request form.

5.2. Before a request is published, its content is available to its author and to the technical systems needed for the Platform to function.

5.3. Once published, the information in a request may be available to other Users within the access provided by the interface.

5.4. The address of the site is not shown to other Users until the terms of the Deal are confirmed.

5.5. Once the terms of the Deal are confirmed, the address of the site is disclosed to the selected Contractor in accordance with the functionality of the Platform.

6. Deal data

6.1. When Users interact through the Platform, the following may be processed:

• the price;
• the duration;
• information about materials;
• estimates;
• information about the request and the bids;
• the generated contract;
• the version of the contract template;
• information about handover and acceptance of the work;
• information about revisions;
• the history of the states of the Deal;
• other information necessary for the Deal to function.

6.2. AITIZ stores a snapshot of the fixed terms of the Deal and the log of its state transitions.

6.3. That information is necessary, in particular, for the Platform to function, for showing the history of the Deal, for confirming the sequence of the Users’ actions, for resolving technical questions and for protecting the rights and lawful interests of the participants.

6.4. The log of state transitions of the Deal is protected against alteration and deletion within the ordinary operation of the Platform.

7. Correspondence and attachments

7.1. When Users use the built-in interaction, AITIZ processes the text of the messages, the attachments, information about the time and order of the messages, and the technical information needed to deliver and display the messages.

7.2. Correspondence may be stored so that the Platform can function and so that the history of the parties’ interaction is preserved.

7.3. AITIZ does not use the content of correspondence for marketing mailings.

7.4. The User must not send through the Platform information whose processing is not required for the interaction concerned, including unnecessary personal data of third parties.

7.5. Among the attachments, the User may send a voice message — an audio recording made by the means of the User’s device.

7.6. A voice message is recorded solely on the User’s initiative: recording starts when the corresponding interface element is pressed and ends when it is pressed again or when the User cancels the recording.

7.7. Access to the device microphone is requested by the device operating system at the first attempt to record. The permission is not requested when the Platform is installed.

7.8. Refusing access to the microphone does not limit the other features of the Platform. Correspondence remains available in text form.

7.9. AITIZ does not record sound outside the User action described in clause 7.6, including in the background and while the application is inactive.

7.10. Together with the audio recording, its duration is processed, which is needed to display the message in the interface.

7.11. Voice messages are processed, stored and deleted on the same terms as other attachments, in accordance with sections 16 and 17 of this Policy.

7.12. A User may report a message using the function provided by the interface. In that case the message concerned enters the review queue and may be viewed by an employee of AITIZ to the extent necessary to review the report.

7.13. Outside the review of a report and outside the technical operations required to deliver, display and store messages, the content of conversations is not viewed by employees of AITIZ.

7.14. When a report is filed, AITIZ processes information about the User who filed it, about the object of the report indicated by that User and about the reason selected, together with any explanation the User has provided.

7.15. Information about the person who filed a report is not disclosed to the User who is the subject of it.

7.16. A User may restrict the receipt of messages from another User using the blocking function. In that case AITIZ processes information about which User applied a block in respect of which User, and the date on which it was applied.

7.17. Information about a block is used solely to restrict the sending of messages and is not shown to the User in respect of whom the block was applied.

8. Reviews and rating

8.1. After a completed Deal, Users may leave reviews and scores in accordance with the functionality of the Platform.

8.2. A review may be left by a participant in the Deal concerned.

8.3. Reviews and replies to reviews may be retained in anonymised form after the author’s account has been deleted.

8.4. After an account is deleted, the corresponding information may be shown with the label “Deleted user”.

8.5. Ratings and reviews are used to show the history of interaction between Users and to form the calculated figures of the Platform.

9. Technical data

9.1. When the Platform is used, the following technical information may be processed automatically:

• the application language;
• the application version;
• the device key for push notifications;
• the IP address;
• session information;
• technical information needed for authorisation and for restoring access.

9.2. The IP address may be processed, in particular, when signing in to an account, when requesting a password reset and when a session is issued.

9.3. Service records containing IP addresses are stored for a limited period.

9.4. In the current configuration such records are stored for 30 calendar days and are then deleted automatically.

9.5. The IP address is not used to determine the User’s location.

9.6. AITIZ does not determine the User’s geographic location by GPS or similar means as a feature of the Platform.

10. What AITIZ does not collect

10.1. For ordinary use of the Platform, AITIZ does not require:

• an individual identification number (IIN);
• an identity document;
• a copy of an identity document;
• payment details;
• bank card data;
• other payment data.

10.2. AITIZ does not collect data about the User’s location by GPS.

10.3. A phone number is not required for registration.

10.4. The phone number is not shown to other Users.

10.5. The User’s email address is not shown to other Users.

10.6. The current version of the Platform sends no marketing mailings.

10.7. AITIZ does not record sound in the background and does not use the device microphone outside the recording of a voice message on the User’s initiative.

11. Purposes of processing

11.1. Personal data is processed for the following purposes:

11.2. The specific processing is determined by the actual functionality of the Platform and by the data provided by the User.

12. Grounds for processing

12.1. AITIZ processes personal data on the grounds provided by the law of the Republic of Kazakhstan.

12.2. Depending on the specific operation, the grounds may be:

• the consent of the personal data subject;
• the need to perform the agreement with the User;
• the need to keep the Platform functioning;
• the performance of obligations established by law;
• the protection of the rights and lawful interests of AITIZ and of Users in the cases provided by law.

12.3. Certain technical data may be processed to the extent necessary to keep the account secure and functioning.

12.4. AITIZ does not process personal data for purposes incompatible with those set out in this Policy without a corresponding lawful ground.

13. Showing data to other Users

13.1. Depending on the profile settings and the User’s role, the following may be shown to other participants of the Platform:

• the display name;
• the photograph;
• the city;
• the specialisation;
• the experience;
• the minimum price;
• the rating;
• the number of reviews;
• reviews and replies;
• the “Verified” mark in respect of an organisation.

13.2. The phone number and the email address are not shown to other Users.

13.3. The address of the site is not shown to Contractors until the terms of the relevant Deal are confirmed.

13.4. Once the Deal is confirmed, the address of the site is disclosed to the selected Contractor to the extent necessary to carry out the work.

13.5. The User understands that information they voluntarily publish in an open profile or in a request may be available to other Users in accordance with the functionality of the Platform.

13.6. The display name is stated by the User personally and is not checked by AITIZ. The Platform informs other Users of this in the interface.

14. The “Verified” mark

14.1. AITIZ may set the “Verified” mark for an organisation.

14.2. That mark is set by an AITIZ employee.

14.3. The mark does not mean:

• confirmation of the identity of a particular individual;
• confirmation of qualifications;
• the existence of licences;
• the existence of approvals;
• confirmation of the quality of the work;
• confirmation of financial stability;
• a guarantee that obligations will be performed.

14.4. In the current version of the Platform, identity documents of individuals are not collected as part of setting this status.

14.5. Automatic verification of the BIN checksum, where applied, is purely a technical check of the structure of the number and does not confirm that the organisation concerned exists or acts in good faith.

15. Transfer of data to third parties

15.1. AITIZ does not sell Users’ personal data.

15.2. AITIZ does not pass personal data to third parties for their own use for advertising purposes.

15.3. Data may be transferred where this is necessary for the Platform to function, for AITIZ to perform its obligations, or where the law so provides.

15.4. The current architecture of the Platform uses technical services to deliver push notifications.

15.5. In particular, Expo Push Service and Google Firebase may be used to deliver push notifications.

15.6. As part of such a transfer, the technical device key and the content of the push notification concerned may be passed to those services, to the extent necessary to deliver it.

15.7. No email provider is connected in the current version of the Platform. If one is connected in the future, the corresponding information must be reflected in the then-current revision of this Policy.

15.8. Data is transferred to state authorities in the cases and in the manner provided by the law of the Republic of Kazakhstan.

16. Storage of data

16.1. AITIZ takes measures to store personal data in the territory of the Republic of Kazakhstan in accordance with the requirements of the applicable law.

16.2. The specific storage infrastructure and the technical placement of data are determined by the server infrastructure used by AITIZ.

16.3. Until the dedicated server infrastructure is finally put into operation, the information about the actual placement of data must correspond to the actual technical arrangement of the Platform.

16.4. Once the Platform has been moved to server infrastructure located in Kazakhstan, the main storage of data takes place on that infrastructure.

16.5. Photographs and attachments are stored in the file storage infrastructure used by AITIZ.

17. Retention periods

17.1. Personal data is stored no longer than is necessary to achieve the purposes of its processing, unless a longer period is provided by law or is necessary to protect rights and lawful interests.

17.2. Service records containing IP addresses are stored for 30 calendar days and are then deleted automatically.

17.3. The data of an active account is stored for the period of its existence and within the limits of the necessary purposes of processing.

17.4. After an account is deleted, AITIZ deletes or anonymises the corresponding personal data in accordance with the account deletion mechanism.

17.5. Reviews and the history of Deals may be retained in anonymised form after an account is deleted.

17.6. Correspondence and information about Deals may be retained after an account is deleted, to the extent necessary to preserve the history of the interaction, to protect the rights and lawful interests of the participants in the Deal and for other purposes provided by law.

17.7. Where such information is retained, it must not be used to restore the User’s deleted profile.

18. Deleting an account

18.1. A User may delete their account directly through the account deletion feature provided by the Platform.

18.2. Deletion is not possible before outstanding Deals are completed, where the Platform imposes such a restriction.

18.3. When an account is deleted, the following are deleted or anonymised:

• the email address;
• the password;
• the phone number;
• the first name;
• the last name;
• the description;
• the photograph;
• the device keys;
• the active sessions.

18.4. The login name may be retained in the system in order to keep identifiers unique and to display the records connected with it correctly.

18.5. After an account is deleted, reviews and the history of Deals may be retained in anonymised form with the label “Deleted user”.

18.6. Retaining the history of Deals is necessary, in particular, to protect the rights of the other party to the Deal and to preserve the integrity of the interaction history.

18.7. The User understands that deleting an account does not necessarily mean the physical deletion of every technical or historical object created as a result of their interaction with other Users.

19. Protection of personal data

19.1. AITIZ applies organisational and technical protection measures having regard to the nature of the information processed.

19.2. Passwords are stored as a cryptographic hash with a salt.

19.3. Access uses tokens with a limited validity period.

19.4. The Platform provides mechanisms for detecting unlawful use of tokens.

19.5. To protect against automated password guessing, the number of sign-in attempts is limited.

19.6. Technical limits are used to restrict mass registration.

19.7. Staff access to data is limited in line with their job duties.

19.8. AITIZ takes reasonable measures to prevent unauthorised access to its information systems.

19.9. Once the server infrastructure is in production operation, secure data transfer protocols must be used.

19.10. AITIZ periodically reviews the technical and organisational security measures applied, having regard to the development of the Platform.

20. Notifications

20.1. To deliver push notifications the Platform uses a technical device key.

20.2. Push notifications may contain information about events connected with the use of the Platform.

20.3. Such events include:

• receipt of a bid;
• selection of a Contractor;
• handover of work;
• acceptance of work;
• return for revision;
• a price request;
• a Supplier’s reply;
• the buyer’s acceptance;
• receipt of a review;
• a moderation decision.

20.4. The content of correspondence between Users is not included in push notifications.

20.5. The User can control the receipt of push notifications through the device settings, where the operating system supports this.

21. Email

21.1. In the current version of the Platform, email is used to restore access to an account.

21.2. The current version of the Platform sends no marketing emails.

21.3. If an external email provider is connected, AITIZ undertakes to update the information about that processor in this Policy to the extent necessary to inform Users.

22. No analytics and no crash reporting

22.1. The current version of the Platform uses no user analytics systems.

22.2. The current version of the Platform uses no separate system for collecting application crash reports.

22.3. If such tools are connected, AITIZ undertakes to assess what data they collect and, if necessary, to amend this Policy.

23. Rights of the User

23.1. The User has the rights provided by the law of the Republic of Kazakhstan in respect of their personal data.

23.2. Depending on the applicable law, the User may:

• obtain information about the processing of their personal data;
• require inaccurate data to be corrected;
• require processing to stop or data to be deleted in the cases provided by law;
• withdraw consent, where processing is based on consent;
• file complaints and applications in the manner established by law;
• exercise other rights provided by law.

23.3. The User may also delete their account themselves through the corresponding feature of the Platform.

23.4. Deleting an account does not cancel the retention of information that lawfully must or may be retained in anonymised form for the purposes set out in this Policy.

24. Enquiries about personal data

24.1. On questions about the processing of personal data the User may contact AITIZ at: yerkesh@aitizglobal.com

24.2. It is recommended that an enquiry state:

• the User’s name;
• the email address linked to the account;
• a description of the request;
• the information needed to identify the enquiry concerned.

24.3. AITIZ considers enquiries within the periods and in the manner provided by the law of the Republic of Kazakhstan.

24.4. Where confirmation that the account belongs to the User is needed in order to reply, AITIZ may request the information necessary for that check, to the extent permitted by law.

25. Data of minors

25.1. Use of the Platform is intended for persons aged 18 and over.

25.2. The User confirms that they meet this requirement themselves.

25.3. The current version of the Platform performs no automatic technical verification of age.

25.4. If AITIZ becomes aware that an account was created by a person below the established age, AITIZ may take measures in accordance with the law and the rules of the Platform.

26. Privacy and public information

26.1. The User should bear in mind that information they voluntarily publish in the public part of a profile, a request, the catalogue or a review may become available to other Users.

26.2. The User decides for themselves what additional information they provide for publication, where the field concerned is optional.

26.3. AITIZ advises against publishing in public fields:

• passwords;
• bank details;
• an IIN;
• identity document data;
• secret codes;
• other information not necessary for interaction through the Platform.

27. Cross-border transfer

27.1. AITIZ seeks to arrange the main storage of personal data in accordance with the requirements of the law of the Republic of Kazakhstan.

27.2. The use of certain technical services may involve those services processing technical data in accordance with their own infrastructure and terms of service.

27.3. In particular, Expo Push Service and Google Firebase may be used to deliver push notifications.

27.4. The amount of data passed to such services is limited to the information necessary for the technical function concerned.

27.5. AITIZ does not pass the whole body of a User’s data to those services merely in order to use a third-party service.

28. Changes to the Policy

28.1. AITIZ may change this Policy in connection with changes in the law, in the functionality of the Platform, in the data storage infrastructure or in the technical services used.

28.2. A new revision is published on the Platform.

28.3. For material changes AITIZ may use additional ways of notifying Users.

28.4. A new revision states the date on which it comes into force.

28.5. Users are advised to review the current revision of the Policy from time to time.

29. Applicable law

29.1. This Policy is governed by the law of the Republic of Kazakhstan.

29.2. Matters of processing and protection of personal data not covered by this Policy are governed by the applicable law of the Republic of Kazakhstan.

30. Contact details of the operator