Privacy Policy

1. General Provisions

1.1. This Personal Data Privacy Policy (hereinafter referred to as the “Policy”) has been developed in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V “On Personal Data and Their Protection” (hereinafter referred to as the “Law”) and sets out the procedure for the collection, processing and protection of personal data of users of the NObal mobile application (hereinafter referred to as the “Application”) and the website https://nobal.kz/ (hereinafter referred to as the “Website”).

The processing of personal data of representatives of establishments and Partners when submitting an application for cooperation, registering and using the Partner account is governed by a separate NObal Privacy Policy for Partners.

1.2. The personal data operator is NObal LLP, BIN 260740021525, registered address: Republic of Kazakhstan, Almaty, Almaly District, 118 Zhambyl Street, Apt. 57, 050012 (hereinafter referred to as the “Operator”).

The Operator determines the purposes and scope of the personal data processed, as well as the actions (operations) performed with such data.

1.3. By clicking the “Continue” button when first launching the Application and/or registering an account in the Application, the User confirms that the User has read this Policy.

Consent to the collection and processing of personal data, as well as to their transfer to third parties and cross-border transfer in cases where such consent is required under the legislation of the Republic of Kazakhstan, shall be provided by the User in a manner enabling the Operator to confirm that such consent has been obtained.

Consent to the processing of personal data shall be provided by the User by ticking a separate checkbox during registration, thereby confirming the User’s freely given, specific and informed consent.

If the User does not agree with the terms of this Policy, the User must cease using the Application and the Website.

1.4. The Application is not intended for persons under 18 years of age. The Operator does not knowingly collect personal data of persons under 18 years of age.

1.5. The following terms are used in this Policy:

“Personal Data” means information or a set of information relating to a personal data subject, supplemented by one or more personal data identifiers.

“Processing of Personal Data” means actions performed with personal data, including accumulation, storage, modification, supplementation, use, transfer, dissemination, anonymisation, blocking and destruction.

“User” means an individual (personal data subject) using the Application and/or the Website.

“Establishment” means a food service or retail establishment that posts offers in the Application.

2. Categories of Personal Data Processed

2.1. Depending on the functions used, the Operator may process the following personal data of the User:

the User’s name;
email address;
IP address — for the purposes of maintaining the User’s session, ensuring security, preventing abuse and limiting the frequency of requests;
location data (geolocation) of the User’s device — exclusively when using the Application and only where permission has been granted by the User in the operating system settings of the device;
reservation and order history: the Establishment’s offer, quantity, order status and pickup confirmation time;
when confirming pickup of an order — device coordinates, location accuracy, distance to the Establishment, information used to detect possible location spoofing and the confirmation time;
ratings assigned by the User to Establishments;
the date and time on which the User accepted the terms of use of the Application, acknowledged this Policy and provided the relevant consents;
the device push token required to send service push notifications and, where the User has provided separate consent, notifications about new packs offered by Establishments;
technical data required to ensure operation of the Application and diagnose failures: device model, operating system and Application version, locale, technical or anonymised User identifier and error information.

2.2. Geolocation is processed for two principal purposes:

displaying offers from nearby Establishments;
confirming pickup of an order at the Establishment.

When displaying offers, the User’s coordinates are used to determine the distance to Establishments and are not stored by the Operator as a separate record of the User’s location.

When confirming pickup of an order, the device coordinates, their accuracy, distance to the Establishment, information used to detect possible location spoofing and the confirmation time are stored together with the order record and used to confirm the fact of pickup, prevent abuse and resolve related disputes.

The User may disable the Application’s access to geolocation at any time through the device settings. In such case, the Application may display offers for the selected city, while functions requiring determination of the User’s actual location, including order pickup confirmation, may become unavailable.

2.3. The Operator does not accept payments and does not process Users’ bank card details. Payment for orders is made by the User directly to the Establishment at the time of pickup.

2.4. The Operator uses technical session identifiers and technical cookies that are necessary for logging into the account, maintaining the User’s session, ensuring security, storing the selected language and retaining certain interface settings.

The Operator does not use advertising identifiers, analytics cookies, analytics systems or advertising tracking tools.

The User’s IP address may be temporarily retained within the User session, rate-limiting systems and technical logs solely for the purposes of ensuring security, preventing fraud, maintaining the operability of the Application and diagnosing technical failures.

3. Purposes of Personal Data Processing

3.1. The User’s personal data are processed for the following purposes:

registering and identifying the User in the Application;
creating and maintaining the User’s account;
sending the User a one-time code for logging into the account and other service messages related to the operation of the account;
sending service push notifications related to orders and operation of the Application;
displaying offers from nearby Establishments based on geolocation or the selected city;
reserving, cancelling and collecting orders, including transferring necessary order information to the Establishment fulfilling the order;
confirming pickup of an order at the Establishment and resolving disputes concerning the fact of pickup;
preventing fraud and abuse;
ensuring the security of the account, the Application and the Website;
providing feedback and support and processing the User’s requests and enquiries;
diagnosing and resolving Application failures;
complying with the requirements of the legislation of the Republic of Kazakhstan;
protecting the rights and legitimate interests of the User, the Operator and third parties;
sending informational and advertising communications — exclusively where the User has provided separate consent, with the ability to opt out at any time.

The Operator shall notify the authorised body of the commencement and termination of personal data processing in accordance with the procedure established by the legislation of the Republic of Kazakhstan.

4. Legal Grounds for Processing

4.1. The legal grounds for processing personal data are:

the User’s consent to the collection and processing of personal data;
entering into and performing the User Agreement to which the User is a party;
requirements of the legislation of the Republic of Kazakhstan.

4.2. The User may withdraw previously provided consent in the cases and in accordance with the procedure prescribed by the legislation of the Republic of Kazakhstan.

Withdrawal of consent shall not result in termination of personal data processing where further processing is permitted or required under the legislation of the Republic of Kazakhstan or is necessary in connection with an outstanding obligation.

4.3. The Operator falls within the small category in accordance with the classification established by the legislation of the Republic of Kazakhstan. The Operator applies personal data protection measures taking into account the applicable category.

5. Transfer of Personal Data to Third Parties and Storage Location

5.1. The Operator transfers personal data to third parties only to the extent necessary to achieve the purposes of processing and ensure operation of the Application and the Website.

Depending on the functions used by the User, personal data may be transferred to:

Establishments — to the extent necessary to reserve and hand over an order;
providers of hosting, server, cloud and other IT infrastructure;
providers of email and service message delivery services;
providers of technical error monitoring and security services;
providers of push notification delivery services;
providers of mapping and geolocation services;
providers of infrastructure used for operation of the Website;
authorised government bodies, courts and other authorised persons — in the cases, on the grounds and in accordance with the procedure prescribed by the legislation of the Republic of Kazakhstan.

Personal data shall be transferred only to the extent necessary for the relevant purpose.

5.2. The Operator’s databases and/or digital objects containing Users’ personal data that are required to be stored within the territory of the Republic of Kazakhstan under the legislation of the Republic of Kazakhstan shall be located within the territory of the Republic of Kazakhstan.

5.3. When certain third-party services are used, a limited scope of personal data may be transferred across borders, including the email address, push token and technical data necessary for provision of the relevant service.

Cross-border transfer of personal data shall be carried out in accordance with the requirements of the legislation of the Republic of Kazakhstan and, where such consent is required under the legislation of the Republic of Kazakhstan, subject to the User’s consent.

5.4. The Operator does not sell Users’ personal data and does not transfer such data to third parties for independent use by such parties for advertising or marketing purposes.

5.5. The Operator does not disseminate the User’s personal data through publicly available sources without the User’s separate consent, except where expressly provided for by the legislation of the Republic of Kazakhstan.

6. Processing Periods, Modification and Deletion of Data

6.1. Personal data shall be processed until the purposes of processing have been achieved or until the User’s account is deleted or consent to processing is withdrawn, whichever occurs first, unless a longer processing or retention period is required under the legislation of the Republic of Kazakhstan or due to the existence of an outstanding obligation.

Certain information may continue to be retained after deletion of the account or withdrawal of consent where necessary to comply with the requirements of the legislation of the Republic of Kazakhstan, maintain records required by law, resolve disputes or protect the lawful rights and interests of the User, the Operator or third parties.

Upon receipt of a notice withdrawing consent, the Operator shall cease processing the personal data within 15 (fifteen) business days unless otherwise provided for by the legislation of the Republic of Kazakhstan.

6.2. Once the purposes of processing have been achieved and the applicable retention periods have expired, personal data shall be deleted, destroyed or anonymised in accordance with the procedure prescribed by the legislation of the Republic of Kazakhstan.

In the cases and to the extent provided for by the legislation of the Republic of Kazakhstan, the User may request deletion, destruction or anonymisation of personal data or restriction of their processing.

6.3. The User may change the User’s name in the “Profile” section of the Application.

The User may delete the account in the Application under “Profile” → “Delete Account”, provided that there are no active reservations, or submit a request to support@nobal.kz from the email address associated with the account.

Upon deletion of the account:

access to the account shall be terminated;
active User sessions and authentication data shall be deleted;
the push token and avatar shall be deleted;
the name and email address in the primary database shall be replaced with technical values that are not intended to be used for further identification of the User.

Information relating to previously completed orders, ratings and enquiries may be retained in anonymised form or to another extent permitted by law for the period necessary to comply with the requirements of the legislation of the Republic of Kazakhstan, resolve disputes and protect the lawful rights and interests of the Operator, the User and Establishments.

Database backups may contain personal data of the User that existed prior to account deletion for a limited period following such deletion. Such backups are used exclusively for infrastructure recovery and are not used for ordinary processing of personal data.

Data previously transferred to third-party providers pursuant to Section 5 of this Policy may be retained by such providers for the periods established by applicable law and their data retention policies.

7. User Rights

7.1. In the cases and to the extent provided for by the legislation of the Republic of Kazakhstan, the User shall have the right to:

obtain information relating to the processing of the User’s personal data;
request amendment, supplementation or correction of inaccurate or incomplete personal data;
request blocking of personal data in cases provided for by law;
request deletion, destruction or anonymisation of personal data or restriction of their processing in the cases and to the extent provided for by the legislation of the Republic of Kazakhstan;
withdraw previously provided consent to the collection and processing of personal data, their transfer to third parties and cross-border transfer in the cases and in accordance with the procedure prescribed by the legislation of the Republic of Kazakhstan;
opt out of informational and advertising communications;
appeal against the Operator’s actions or omissions in accordance with the procedure established by the legislation of the Republic of Kazakhstan;
protect the User’s rights and legitimate interests by other means provided for by the legislation of the Republic of Kazakhstan.

7.2. To exercise these rights, the User may submit a request to the Operator by email at support@nobal.kz or by post to the address specified in Clause 1.2 of this Policy.

To prevent unauthorised access to, disclosure, modification or deletion of personal data, the Operator may request additional information necessary to verify the User’s identity.

The Operator shall review requests and provide responses within 3 (three) business days from receipt of the request, unless other time limits are prescribed by the legislation of the Republic of Kazakhstan.

8. Personal Data Protection Measures

8.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, supplementation, blocking, copying, dissemination, loss and other unlawful actions.

Such measures include, in particular, restricting access of employees and contractors to personal data, using secure data transmission channels, and applying technical and organisational information security measures.

8.2. Nevertheless, no method of transmitting information over the Internet or data storage system can guarantee absolute security.

8.3. In the event of a personal data security breach, the Operator shall notify the authorised body within the period prescribed by the legislation of the Republic of Kazakhstan, but in any event no later than 1 (one) business day from the moment the incident is detected.

Notification of the authorised body regarding the incident shall be sent using cryptographic information protection tools in accordance with the requirements of the legislation of the Republic of Kazakhstan.

If the User believes that the User’s account or personal data may have been compromised, the User may report this to support@nobal.kz.

9. Final Provisions

9.1. The Operator may amend this Policy, including in connection with changes in legislation, functionality of the Application and the Website, the categories of personal data processed or the technologies used.

The current version of the Policy shall be published on the Website and/or made available through the Application interface.

In the event of material amendments, the Operator may additionally notify Users by an available means.

Where the relevant amendments require new or additional consent from the User under the legislation of the Republic of Kazakhstan, such consent shall be obtained before the relevant processing of personal data begins.

9.2. Users’ enquiries regarding the collection, processing, storage, transfer and protection of personal data shall be considered by the Operator within the periods and in accordance with the procedure prescribed by the legislation of the Republic of Kazakhstan.

The User may appeal against the Operator’s actions or omissions and protect the User’s rights in accordance with the procedure established by the legislation of the Republic of Kazakhstan.

9.3. This Policy and the relationship between the User and the Operator relating to the collection, processing and protection of personal data shall be governed by the legislation of the Republic of Kazakhstan.

9.4. All suggestions, requests and questions regarding this Policy should be sent by email to support@nobal.kz or by post to the Operator’s address specified in Clause 1.2 of this Policy.

9.5. The person responsible for organising the processing of personal data is Daulet Zhanbekuly, Director of NObal LLP.

Contact: support@nobal.kz.

Information regarding the responsible person, including the person’s contact details, shall be submitted to the authorised body in accordance with the procedure and within the time limits established by the legislation of the Republic of Kazakhstan for inclusion in the relevant register.