Privacy Policy

1. What we collect

• Phone number — required to sign in; verified with a one-time SMS code.
• Name and, optionally, e-mail address — for your profile and support requests.
• Delivery addresses — only if you order delivery.
• Location — with your permission and only while choosing the nearest branch or an address; never tracked in the background.
• Order history, bonus balance, loyalty tier, promo codes and subscriptions.
• Photos — only if you upload an avatar or publish a recipe in the drink builder.
• Technical data: device identifier and push token, device model and OS version, language, usage events, crash reports.
• We do not collect or store payment card details (card numbers, CVV): payments are processed by payment providers on their side.

2. Why we need it

• Registration, sign-in and account protection.
• Accepting, preparing, handing over and delivering orders; status notifications.
• Loyalty programme: earning and spending bonuses, promo codes, subscriptions, referral rewards.
• Customer support and handling complaints.
• Analytics, improving the App and fixing bugs.
• Preventing fraud and abuse.
• Complying with legal requirements (accounting, fiscal receipts).

3. Legal basis

We process data on the basis of the consent you give at registration, to perform the contract (public offer) when you place an order, and where the law directly requires it. You can withdraw consent by deleting your account (section 7).

4. Who we share data with

We share data only with providers without whom the service cannot be delivered, and only to the extent necessary:

• Payment providers (Kaspi, Halyk ePay, Alipay, Apple Pay, Google Pay) — amount and order number; card details are entered on their side.
• Yandex Maps and Yandex Delivery — coordinates and address to show the map and fulfil delivery.
• SMS provider — phone number to send the verification code.
• Google Firebase and Sentry — push tokens, anonymised analytics and crash reports.
• Restaurant management system (iiko) — order contents for the till and kitchen.
• Government authorities — only upon a lawful request.
• We do not sell personal data and do not share it for third-party advertising. The App does not use tracking for targeted ads.

5. Storage and security

Data is transmitted only over encrypted channels (TLS). Personal data is encrypted at rest and access is limited to staff who need it for their work.

Data is kept while your account is active. After account deletion your profile, bonuses and order history are erased within 30 days, except for records we must keep by law (for example payment and fiscal receipt data, for the statutory period).

6. Your rights

Requests are accepted at support@balbakery.kz. We reply within 10 business days.

• Learn what data we process about you and obtain a copy.
• Correct your name, e-mail and addresses in the App profile.
• Delete your account and data (section 7).
• Withdraw consent and opt out of push notifications in your device settings.
• Lodge a complaint with the Company or with the personal data protection authority.

7. Deleting your account

• In the App: Profile → Settings → “Delete account”. The account is closed immediately and the data is erased within 30 days.
• By request: e-mail support@balbakery.kz stating the phone number linked to the account — we will confirm your identity with an SMS code.
• After deletion, bonuses, subscriptions and order history cannot be restored. Active orders will be completed.

8. Children

The App is intended for users aged 16 and over. We do not knowingly collect children’s data; if you believe a child has provided us with data, contact support and we will delete it.

9. Website and cookies

The public online menu at menu.balbakery.kz uses only technically necessary browser data (such as the chosen theme and language) and does not use advertising cookies.

10. Links, QR codes and invitations

When you open a Bal Bakery link or QR code (app.balbakery.kz) in a browser, we record the visit: which QR code or invitation was opened, the device type, the operating system version and the language. The IP address is not stored — only an irreversible hash of it, and only for 30 days; after that only anonymous daily counts remain.

On first launch the App sends us a random install identifier, the operating system version and the language, and on Android the Google Play data about the link the app was installed from. This tells us which QR codes and invitations work and lets us fill in a friend's code at sign-up. On iPhone the source of an install is estimated — from a recent link visit on the same network with the same system version and language; you see the filled-in code and can remove it.

This data is not shared with other companies and is not used to track you across other companies' apps or websites.

11. Changes

We may update this Policy. The current version and date are always available on this page; we will notify you in the App about material changes.

12. Contact

Bal Bakery — support@balbakery.kz. Legal entity details are available on request and are shown on the fiscal receipt.