Privacy Policy

Mvoter Technologies LLP«
Effective date: August 10, 2026
Address: Republic of Kazakhstan, Astana, Maylin St., house 4/1, apt. 108
Email: support@superqr.com
Phone: +7 (747) 359-59-59
Website: https://superqr.com

1. General Provisions

This Policy describes what personal data LLP «Mvoter Technologies» (hereinafter — the «Company», «we») collects, how it uses it, to whom it transfers it, how long it stores it, and how it protects it.

The policy applies to:

• website superqr.com and feedback forms on it;
• SuperQR personal account and platform plug-in modules: online menu, staff call button, online queue, online booking and reservation, online catalog and store, feedback collection, checklists, service requests, time tracking;
• pages that visitors open after scanning the QR code;
• mobile application «SuperQR Staff» for establishment employees (Google Play, package identifier com.superqr.staff).

By using the website, personal account, or mobile application, you confirm that you have read this Policy. The processing of personal data is carried out in accordance with the Law of the Republic of Kazakhstan No. 94-V «On Personal Data and Their Protection» dated May 21, 2013.

2. Roles of the parties

Regarding business representatives who register an account on the platform and visitors of the superqr.com website, the Company acts as by the operator personal data.

Regarding the data of the establishment's employees and its customers, the Company acts as by the handlerThis data is entered by the establishment (the account owner), which also determines the purposes of their processing, and we process them on its behalf to the extent necessary for the platform's operation.

3. What data we collect

3.1. Account owner data (business representative)

• first and last name, email address, phone number;
• organization name, field of activity, addresses of establishments;
• when logging in via Google — email address and name from the Google profile;
• information on the selected tariff, payments, and issued invoices.

3.2. Employee data in the SuperQR Staff app«

• employee name, their position or role (waiter, chef, administrator, and others) and association with the establishment — this information is entered by the establishment administrator;
• phone number and PIN code used for login; the PIN code is stored only in an irreversibly transformed (hashed) form;
• selected interface language;
• work actions in the app: accepted orders and calls, request and booking statuses, task completion marks.

Self-registration in the app is not possible: the employee account is created by the venue administrator in the personal account.

3.3. Technical data

• Firebase Cloud Messaging push notification token and app installation identifier;
• device model, operating system version and application version;
• IP address, date and time of requests to our servers, service error logs;
• cookies and similar technologies on the website and in the personal account (see section 7).

3.4. User-uploaded content

An employee can attach a photo to a service request, a reservation, or a checklist item. Camera and gallery access is requested only at the moment of such an action; the app does not scan the gallery or upload images without explicit user action. The photo is transmitted only to the request it is attached to and is available to the employees and administrators of that venue.

3.5. Venue visitor data

When using client services (menu, order, review, appointment, reservation, queue), the name, phone number, order or review content, table number, and visit time may be processed to the extent specified by the visitor. This data is processed on behalf of the establishment.

3.6. What data we do not collect

The SuperQR Staff application does not request or collect location data, contacts, SMS, call history, list of installed applications, calendar, microphone audio, files outside of images selected by the user, or the device advertising identifier. The application contains no advertising networks or third-party analytics SDKs. We do not use personal data for advertising, profiling, or automated decision-making, and we do not sell it.

4. Mobile app permissions

• Internet — data exchange with platform servers;
• POST_NOTIFICATIONS — display of push notifications for new orders, calls, requests, and bookings;
• camera and image selection access is requested by the system only upon an explicit user action when attaching a photo (section 3.4).

5. Purposes of Processing

• provision of access to the platform and application, user authentication;
• operation of connected modules: transmission of orders to the kitchen, calls to the waiter, requests and reservations to responsible employees;
• delivery of push notifications about events requiring employee action;
• generation of operational statistics of the venue (by orders, tables, staff);
• subscription management, invoicing, and refunds;
• technical support and ticket processing;
• ensuring security: detecting abuse, rate limiting, incident investigation;
• compliance with legal requirements.

Legal grounds for processing: consent of the personal data subject, performance of a contract with the establishment, legitimate interests of the Company in ensuring the operability and security of the service, and legal requirements.

6. To whom the data is transferred

• Google LLC — the Firebase Cloud Messaging service, through which push notifications are delivered. The device token and notification text (for example, table number and order contents) are transmitted;
• payment providers and acquiring banks — when paying for the subscription. Bank card details are entered on a secure provider page, are not transmitted to us, and are not stored on our servers;
• hosting service provider — regarding the hosting of the platform servers;
• email delivery service — registration emails, invoices, and system notifications;
• external systems connected by the establishment itself — for example, the iiko restaurant automation system or the venue's CRM. The venue determines the composition of the transmitted data when connecting the integration;
• state authorities — upon a justified request in the manner established by law.

We do not sell personal data or share it with third parties for their own marketing purposes.

7. Cookies

The website and user account use cookies required for session operation and saving settings (interface language, authorization), as well as web analytics service cookies to measure traffic. You can disable cookies in your browser settings; however, logging into your user account will then become impossible. The mobile application does not use cookies: the access token is stored in the device's secure storage.

8. Retention periods

• account and establishment data — for the term of the agreement and 3 (three) years after its termination, unless a longer period is established by law;
• employee account — until deleted by the venue administrator;
• push notification token — until the app is closed, uninstalled, or the token is replaced;
• server access logs — up to 12 months;
• accounting and payment documents — 5 (five) years in accordance with the legislation of the Republic of Kazakhstan.

9. Data deletion

The venue administrator can delete an employee account independently in their personal account; after deletion, the employee loses access to the application.

To delete your account and associated personal data, send a request from the email address provided during registration to support@superqr.com with the subject «Data Deletion». We confirm receipt of the request and will delete the data within 30 (thirty) calendar days, with the exception of information that we are required by law to retain (for example, accounting documents). Data included in backups is deleted as part of their scheduled rotation.

10. Data Protection

• data exchange between the application, website, and servers is secured by the TLS (HTTPS) protocol;
• passwords and PIN codes are stored only as irreversible hashes;
• access tokens in the mobile application are stored in the operating system's secure storage (Android Keystore) and are inaccessible to other applications;
• Company employees' access to data is restricted and granted on a need-to-know basis;
• the platform has a role-based access control system: an employee can only see data for the specific venue and module to which they have been granted access;
• Rate limiting and PIN brute-force protection are applied.

No method of data transmission and storage provides absolute protection, so we cannot guarantee unconditional security, but we take reasonable and sufficient measures to ensure it.

11. User Rights

• obtain information about what data is being processed and for what purpose;
• demand the correction of inaccurate or incomplete data;
• to demand the deletion of data or the blocking of its processing;
• revoke previously given consent to processing;
• appeal the actions of the Company to the authorized body for the protection of personal data of the Republic of Kazakhstan.

Send requests to support@superqr.com. The response is provided within 30 calendar days. If the data was entered by the employing establishment, we will redirect the request to them as the account owner and notify you accordingly.

12. Cross-border transfer

The platform's servers are located within the Republic of Kazakhstan. Data is transferred outside the Republic of Kazakhstan only when delivering push notifications via the Google LLC infrastructure and when using external services listed in Section 6, under conditions that ensure the protection of the transferred data.

13. Minors

The platform and application are intended for professional use by adults. We do not knowingly collect data from individuals under the age of 18. If such data is identified, it will be deleted.

14. Policy Changes

We may update this Policy. The current version is always available at https://superqr.com/politika-konfidenczialnosti/, the effective date is indicated at the beginning of the document. We notify account holders of material changes via email at least 10 days before the changes take effect.

15. Contacts

Mvoter Technologies LLP«
Republic of Kazakhstan, Astana, Maylin Street, House 4/1, Apt. 108
Email: support@superqr.com
Phone: +7 (747) 359-59-59

Payment and refund policies are located on a separate page: Payment and refund policies.