This Policy describes which personal data the operator of the User-QR service (website uqr.kz, hereinafter the “Service”, “we”) processes, for what purpose, and what rights users have. Processing is carried out in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V of 21 May 2013.
1. Who we are and how to contact us
The Service is operated by the User-QR team, Kazakhstan. For personal-data matters message us on WhatsApp +7 701 027 3772 or on Instagram @uqr.kz. The operator's legal requisites are provided on request and are stated in the contract (invoice) when a subscription is paid.
2. Roles: operator and venue
Two groups use the Service. Venue owners and staff register an account and manage the menu. Venue guests open the menu via a QR code and may place an order or a booking. Guest data that a venue collects through its own menu (orders, bookings, feedback) is processed by the venue as an independent controller for its own purposes; we process it only to deliver it to the venue and keep the Service running.
3. What data we collect
When a venue registers: first and last name, phone number (used as the login), password (stored only as a hash), the venue name and details you enter yourself: menu, photos, address, opening hours, social links, the WhatsApp number for orders.
From menu guests: name and phone number entered in the order, delivery or booking form; table number; order contents; feedback text and photos if the guest leaves them. Guests do not need to register.
Technical data: the language-choice cookie (NEXT_LOCALE), the session cookie for signing in to the admin panel, cart contents in the guest's browser local storage; IP address and browser data in server logs; web analytics data.
Payments: subscriptions are paid via Kaspi. We do not receive bank card data — only the payment status and purpose.
4. Analytics, cookies and pixels
The site runs Yandex Metrica (including click maps and session replay — Webvisor) and, when enabled, Google Analytics. A venue on the Pro plan may connect Meta (Facebook) Pixel to its menu pages — in that case Meta receives menu-visit data under its own rules and the venue is responsible for it. You can restrict cookies and trackers in your browser settings; the core functions of the Service keep working.
5. Why we process data
- to provide the Service: show the menu, pass orders, bookings and feedback to the venue via Telegram or WhatsApp;
- to maintain the venue account, issue invoices and confirm subscription payments;
- to respond to support requests;
- to improve the Service and protect it from abuse (analytics, logs, rate limiting);
- to comply with legal requirements.
The legal bases are user consent (at registration and when submitting forms) and performance of the service agreement.
6. Who receives the data
Data is shared only with parties needed to run the Service: hosting and file storage in Kazakhstan, analytics services, Telegram and WhatsApp for notifications, Kaspi for payments, and the venue whose menu the guest uses. We do not sell personal data and do not pass it to third parties for their own advertising.
7. Retention and security
Account data is kept while the account is active and deleted on the owner's request or after prolonged inactivity, subject to statutory document-retention periods. Photos and files are stored in S3-compatible storage in Kazakhstan. Access to the admin panel is protected by passwords, staff roles and rate limiting; the connection to the site is encrypted (HTTPS).
8. Your rights
You may request access to your data, correct it, delete it, withdraw consent or restrict processing. A venue owner can change data in the admin panel or request account deletion. A guest may contact the venue or us. Requests are accepted via the WhatsApp and Instagram contacts in section 1; we reply within a reasonable time.
9. Children
The Service is intended for business owners and adult guests. We do not knowingly collect data of persons under 18 without a legal guardian's consent.
10. Changes to this Policy
We may update this Policy. The current version is always published on this page with an update date. We additionally notify venue owners of material changes via their contact number.
Updated: 7 September 2026.