The owner and operator of personal data is TRIO LABS LLP, business identification number 260840005834, Almaty, Republic of Kazakhstan. Contact for data processing matters: support@qfindo.kz.
Processing is carried out in accordance with the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V "On Personal Data and its Protection" and other applicable legislation.
2. What data is processed
Account: telephone number, nickname, password hash, the fact and method of number verification, city, profile picture.
Listings: title, description, category, photographs, date of the event, coordinates of the place and the locality.
Interaction: claims, chat messages, complaints, moderation outcomes, records of handover arrangements.
Settings: favourites, the list of blocked users, language preferences, notification and location permissions.
Technical data: IP address, device and operating system details, application version, push notification identifiers, the Firebase installation identifier and the advertising identifier, session and security event logs.
Payments: the contents of an order, the service name, amount, currency, status and transaction identifier. Full payment card details are neither passed to nor stored by the operator.
Consents: the version of the document accepted, and the date and time of acceptance.
3. Purposes and legal grounds
Data is processed to: register and authenticate users; publish and display listings; search for probable matches; exchange messages between users; operate the map and distance-based features; send notifications; moderate content and counter fraud; take and record payments; support users; keep backups; and comply with obligations imposed by law.
Grounds for processing: the data subject's consent; performance of a contract to which the subject is a party; compliance with an obligation imposed on the operator by law; and protection of the rights and legitimate interests of the operator and other users where this does not infringe the subject's rights.
Separate consent is requested for access to location, for push notifications, and in other cases where the law requires separate consent.
4. What other users can see
Publicly displayed: nickname, profile picture, the verification mark, the content of a listing, photographs, category, locality, date and approximate place.
Not published: telephone number, exact coordinates, the content of conversations, payment details. A telephone number becomes available to a particular user only after the action provided for in the service and with the consent of the number's holder.
Before contact is opened, an organization account is shown as an anonymised partner-organization mark; the organization's name and details are disclosed to the administrator and to the other side in an open conversation.
5. Recipients
The operator engages the following categories of processors and passes them data to the extent needed for the relevant function:
Hosting and processing of the main database — server infrastructure in the Republic of Kazakhstan.
Storage of photographs and backups — Cloudflare, Inc. (object storage).
Delivery of one-time codes — SMS providers and flash-call services engaged by the operator.
Payment acceptance — the payment organisation servicing card acceptance, and application stores for in-app purchases.
Maps and geocoding — providers of cartographic data.
Automated matching — the operator's own computing resources and model providers engaged under contract.
Data is provided to public authorities solely on a lawful and reasoned request, within the limits set by law.
The operator does not sell personal data and does not pass it to third parties for their own marketing purposes.
6. Cross-border transfer
The main database of accounts, listings and transactions is held in the Republic of Kazakhstan.
Certain categories of data are transferred abroad: photographs and backups to Cloudflare's infrastructure; device identifiers, notification tokens and crash reports to Google's infrastructure; and the data needed to display advertising to Google's advertising services.
Such transfer is carried out on the basis of the user's consent, given on acceptance of this Policy, and on condition that the recipient ensures the protection of personal data. The user may withdraw consent as described in clause 10; dependent features, such as notifications and photograph upload, may then become unavailable.
7. Location
Coordinates are used to show a listing on the map, calculate distance, search nearby and notify about finds in the vicinity. The public interface does not disclose the exact place: an approximate area is shown.
Permission to access location is granted by the user and may be withdrawn in the device settings at any time.
8. Messages, moderation and automated processing
The content of a conversation is available to its participants. When a complaint is received, the related part of the conversation and account details become available to the operator's authorised staff to the extent needed to deal with it.
The operator applies automated rules to detect spam, attempted fraud, the passing of contact details outside the service and prohibited content. Decisions with significant consequences, such as restricting an account or removing a listing, may be reviewed by a member of staff on the user's application.
Automated matching compares descriptions and images and produces a probability. It is not a decision about who owns an item. Do not post documents, card numbers or other confidential information in listings.
9. Retention periods
Account and listing data — until the user deletes the account or the purpose of processing is achieved.
Payment records and primary accounting documents — for the period set by accounting and tax legislation.
Records of consent — for the period the consent is in force and three years afterwards.
Security logs and materials relating to complaints and disputes — for as long as needed to protect rights, and no more than three years after the matter is closed.
Backups — no more than thirty days, after which they are overwritten automatically.
Once these periods expire, data is destroyed or anonymised.
10. Rights of the data subject and how to exercise them
The user has the right to: obtain information about which of their data is processed and to whom it has been passed; require data to be amended or supplemented where it is incomplete or inaccurate; require data to be blocked where there is evidence that the conditions of processing have been breached; require the destruction of data processed in breach of the law; and withdraw consent to processing.
How to exercise them:
changing the nickname, city and profile picture — in the service settings;
deleting particular data (listings, photographs, the profile picture, favourites, the block list, claims) — in the service interface, as described at qfindo.com/account-deletion;
deleting the account entirely — in the service settings, or by a request made as described on the same page;
other requests, including withdrawal of consent and information about processing — to support@qfindo.kz.
A request is dealt with within thirty calendar days of confirming that the account belongs to the applicant.
Withdrawal of consent ends the processing, except where processing continues on another lawful ground, including compliance with obligations imposed by law and the defence of claims.
The user may complain to the authorised personal data protection body of the Republic of Kazakhstan.
11. Cookies and similar technologies
The website uses cookies and similar technologies that are necessary for the session and for security, and those used by Google's advertising services. These can be managed in the browser settings; disabling some of them may limit how the service works.
12. Security measures
The operator applies access segregation, encrypted connections, storage of passwords as irreversible hashes, multi-factor authentication for staff with administrative access, action logging, regular backups and tools for detecting unauthorised access.
If an incident involving a breach of personal data protection is detected, the operator acts in the manner prescribed by law and takes steps to mitigate the consequences.
13. Minors
The service is not intended for persons under sixteen. The operator does not deliberately collect their data. Where such data is identified, it is deleted.
14. Changes to this Policy
A new edition is published with a version number and an effective date. Where changes affect the data collected, the purposes or the recipients, the operator notifies users and, where the law requires it, requests fresh consent.
15. Contact
Questions and requests relating to the processing of personal data: support@qfindo.kz, TRIO LABS LLP, Almaty, Republic of Kazakhstan.
