PRIVACY POLICY Last updated: [11.04.2026] 1. Definitions 1.1 For the purposes of this Privacy Policy, the following terms shall have the meanings set forth below: “Company” means the Limited Liability Partnership "FATON", BIN 260340014002, a duly registered legal entity in accordance with the laws of the Republic of Kazakhstan, which is the owner of the Application; “User” or “Users” means a legally capable individual using the Application under the terms defined in the User Agreement to: (i) place Orders for Goods; (ii) arrange delivery of Shipments; (iii) order passenger transportation services (taxi); “Application” means the software "FATON" for mobile devices provided to Users under the terms specified in the User Agreement for accessing the Services; “Services” means the set of services available to the User through the Application, including: ordering Goods; delivery of Goods; delivery of Shipments; passenger transportation services (taxi); “Goods” means any goods, products, or items, including but not limited to food, prepared meals, beverages, as well as non-food items (including clothing, hygiene products, household and other goods), offered by Partners for sale and/or preparation (where applicable) and available for order by the User through the Application, provided that their sale is not prohibited by the laws of the Republic of Kazakhstan; “Shipment” means documents, correspondence, as well as other items and goods transferred by the User for delivery to another person via the Application. The User may request delivery of a Shipment from point A to any point B, specifying the sender and recipient; “Driver” means an individual, individual entrepreneur, or legal entity providing passenger transportation (taxi) services using a vehicle, acting as an independent partner and not as an employee of the Company; “Partner” means a legal entity or individual entrepreneur engaged in the preparation and/or sale of Goods to Users of the Application when placing Orders through the Application, and also performing delivery of Goods to Users in cases where such functionality is предусмотрена (provided) by the Application; “Policy” means this Privacy Policy; “Payment Provider” means a legal entity or payment organization providing services for processing and executing payments using bank cards and other electronic payment methods, as well as ensuring technological interaction between the issuing bank, the acquiring bank, and the Company; “Courier” means a legal entity, individual entrepreneur, or individual (not an employee of the Company) providing delivery services for Shipments and/or Goods; “Order” means a request placed by the User through the Application to receive Services; “Personal Data” means any information relating to a directly or indirectly identified or identifiable individual (data subject), which the Company obtains or processes through the Application in the course of providing its services in accordance with the User Agreement. 2. General Provisions 2.1. This Policy defines the procedure for the collection, processing, storage, and protection of personal data of Application Users, the rights holder of which is the Company. 2.2. The Policy has been developed in accordance with the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan “On Personal Data and Their Protection.” 2.3. By using the Application, the User gives consent to the collection and processing of their personal data under the terms of this Policy. At the same time, the User understands the purposes and conditions of the collection and processing of their personal data. 2.4. In case of disagreement with the terms of this Policy, the User must cease using the Application. 2.5. The Company does not verify the accuracy of the personal data provided by the User but assumes that the User provides up-to-date personal data. The User bears responsibility for any consequences arising from the provision of inaccurate and/or incorrect personal data. 2.6. The User’s personal data shall be processed only to the extent strictly necessary to achieve the purposes specified in this Policy and may not be used for other purposes without obtaining additional consent from the User. 3. Personal Data Operator The personal data operator is: Limited Liability Partnership "FATON" BIN 260340014002 Registered address: Republic of Kazakhstan, Almaty, Auezov District, 87 Zhandosov Street, postal code 050043 Email: info@faton.kz 4. Personal Data Collected by the Company 4.1. The Company may collect the following categories of personal data: 4.1.1. Registration Data for Creating a User Account in the Application: • First name, last name, patronymic (if indicated in an identity document); • Phone number; • Email address. 4.1.2. User Profile Data: • Delivery addresses; • Order history; • User preferences. 4.1.3. Geolocation Data The Application may request access to the User’s geolocation data in order to: • Display nearby Partners (e.g., restaurants); • Determine the delivery address; • Optimize Courier routes; • Determine the User’s location for placing an Order; • Match the nearest Partners, Couriers, and Drivers; • Organize delivery and/or dispatch a vehicle; • Track the Order status in real time; • Prevent fraud and abuse. Access to geolocation is granted only after the User provides permission via the mobile device settings. The User may restrict or disable access to geolocation at any time; however, this may affect the availability and proper functioning of certain features of the Application. 4.1.4. Payment Information Payments in the Application may be processed through Payment Providers. The Company does not store full bank card details of Users. 4.1.5. Technical Data The following technical data may be collected automatically: • IP address; • Type of device on which the Application is installed; • Operating system version; • Application version; • Device identifiers; • Application usage logs. 4.1.6. Cookies and Similar Technologies The Application may use cookies and similar technologies for: • User authentication; • Storing user preferences; • Analyzing Application usage; • Improving performance and security. Cookies may be placed both by the Company and by third-party analytics service providers. The User may restrict the use of cookies through the mobile device settings. 4.1.7. Analytics and Third-Party Services The Company may use third-party analytics and monitoring services to analyze Application usage and improve service quality. Such services may include: • Mobile application analytics systems; • Error monitoring services; • Marketing analytics tools. These services may collect anonymized technical data. 5. Purposes of Personal Data Processing The Company processes Users’ personal data for the following purposes: • Registration of an account in the Application and identification of the User; • Creation, processing, and fulfillment of the User’s Orders; • Transfer of necessary data to Partners (e.g., restaurants) for Order preparation; • Transfer of necessary data to Couriers for organizing delivery of the Order to the User; • Interaction with Partners and Couriers in the course of Order fulfillment; • Provision of customer support and feedback to Users; • Processing of payments, transactions, and refunds; • Sending informational and promotional messages to Users; • Improving the functionality and performance of the Application, including analysis of user experience; • Prevention of fraud, abuse, and other unlawful activities; • Compliance with the legislation of the Republic of Kazakhstan; • Transfer of data to Drivers for organizing passenger transportation services; • Ensuring communication between the User, Courier, Driver, and Partner; • Ensuring the safety of Users when using the Services; • Resolution of disputes between Users and third parties. 6. Storage and Protection of Personal Data 6.1. Users’ personal data are stored on servers with restricted access located within the territory of the Republic of Kazakhstan, ensuring an adequate level of protection of the rights of personal data subjects. 6.2. The Company takes necessary organizational and technical measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. 7. Transfer of Personal Data to Third Parties 7.1. The Company does not transfer Users’ personal data to third parties, except in cases expressly предусмотренных (provided for) by this Policy or the legislation of the Republic of Kazakhstan. 7.2. Personal data may be transferred to third parties solely to the extent necessary to achieve the purposes of processing specified in this Policy: 7.2.1. Partners (Restaurants) For the creation and preparation of the User’s Order, the following personal data may be transferred to Partners: • First name, last name, patronymic (if indicated in an identity document) of the User; • User’s phone number; • Order information (order contents, User’s comments to the order). 7.2.2. Couriers For organizing and carrying out delivery of the Order to the User, the following personal data may be transferred to Couriers: • First name, last name, patronymic (if indicated in an identity document) of the User; • User’s phone number; • Delivery address; • User’s delivery comments. If, when placing an Order, the User specifies a sender and/or recipient who is not the User, the Company collects and processes the personal data of such persons solely for the purpose of delivering the Shipment from the sender to the recipient. The User guarantees that they have obtained the consent of the sender and recipient for the collection and processing of their personal data by the Company for the purpose of fulfilling the User’s Order. 7.2.3. Payment Providers For processing payments and refunds, the following data may be transferred to Payment Providers: • First name, last name, patronymic (if indicated in an identity document) of the User; • Order number; • Payment amount; • Payment status; • Transaction identifier. 7.2.4. Technical Infrastructure Providers (Hosting Providers, Cloud Services) To ensure the functioning of the Application, such parties may have access to the following personal data: • First name, last name, patronymic (if indicated in an identity document) of the User; • User’s phone number; • User’s email address; • Order history; • IP address; • Data on the date and time of Application usage. 7.2.5. Analytics Services For analyzing Application usage and improving its functionality, the following data may be transferred: • IP address; • Device type; • Device operating system; • Application version; • Data on User actions within the Application (screen views, Order placement, Order cancellation). 7.2.6. Drivers (Taxi) For the provision of passenger transportation services, the following personal data may be transferred to Drivers: • User’s name; • User’s phone number; • Route information (pickup location and destination); • User’s comments. 7.2.7. Shipment Recipients In the case of Shipment delivery, personal data may be transferred to the recipient and/or Courier: • Name of the sender and/or recipient; • Phone number; • Delivery address; • Delivery comments. 8. Duration of User Consent for the Collection and Processing of Personal Data 8.1. The User’s consent to the collection and processing of personal data shall remain valid from the moment it is given until the purposes of personal data processing are achieved or until such consent is withdrawn by the User. 8.2. The User’s personal data shall be stored no longer than necessary for the purposes of processing, including the period during which the User maintains an account in the Application. In the event the User deletes their account, personal data shall be deleted or anonymized, except for data that must be retained for the periods established by the legislation of the Republic of Kazakhstan (including for accounting, tax reporting, and confirmation of completed payment transactions). 9. Cross-Border Transfer of Personal Data 9.1. The Company does not carry out cross-border transfer of Users’ personal data. 9.2. All operations related to the collection, storage, and processing of personal data are carried out within the territory of the Republic of Kazakhstan. 9.3. If a need for cross-border transfer of personal data arises, such transfer will be carried out by the Company only in compliance with the requirements of the legislation of the Republic of Kazakhstan on personal data protection. 9.4. At the same time, the Company shall not be liable for any possible cross-border transfer of personal data carried out by third parties (including Partners, Couriers, Payment Providers, and other service providers) if such transfer is performed independently by them and outside the Company’s control. 10. Dissemination of Personal Data in Public Sources 10.1. The Company does not disseminate Users’ personal data in publicly available sources. 10.2. Users’ personal data are not made publicly available by the Company and are not transferred for publication in public sources without the User’s consent, except in cases expressly provided for by the legislation of the Republic of Kazakhstan. 11. User Rights 11.1. The User has the right to: • Obtain information about their personal data and its processing; • Request correction or updating of inaccurate or incomplete personal data; • Request blocking of their personal data in case of violations of the conditions for collection or processing; • Request deletion of their personal data if such data has been collected or processed in violation of the legislation of the Republic of Kazakhstan, as well as in other cases предусмотренных (provided for) by law; • Withdraw consent to the collection and processing of personal data; • Exercise other rights provided for by this Policy and the legislation of the Republic of Kazakhstan. 11.2. To exercise these rights, the User must contact the email address specified in this Policy. 11.3. In the event the User withdraws consent to the processing of their personal data, the Company shall cease processing such data within fifteen (15) business days, unless storage or processing is required under the legislation of the Republic of Kazakhstan, or shall provide the User with a reasoned refusal. 11.4. Withdrawal of consent to the processing of personal data makes further use of the Application by the User impossible. In such cases, the User’s account shall be deleted by the Company. 12. Personal Data Security The Company applies necessary organizational and technical measures to protect personal data from: • Unauthorized access; • Alteration; • Disclosure; • Destruction. 13. Data of Minors 13.1. The Application is not intended for persons under 18 years of age. 13.2. The Company does not knowingly collect personal data of minors. 14. Changes to the Policy 14.1. The Company reserves the right to make changes and additions to this Policy at any time. 14.2. The current version of the Policy is always available in the Application. 14.3. The User undertakes to independently monitor changes and updates to this Policy. Continued use of the Application after changes to the Policy shall be deemed as the User’s acceptance of such changes. Changes and updates to the Policy come into force from the moment they are published in the Application. 14.4. If the User does not agree with the changes and updates to the Policy, they must cease using the Application and delete their account and may also send the Company a written request for the deletion of their personal data. 15. Contact Information For any questions regarding the processing of personal data, the User should contact: Limited Liability Partnership "Faton" E-mail: info@faton.kz