UTASKO SERVICE PRIVACY POLICY

MVoter Technologies Limited Liability Partnership
Effective date: June 1, 2026
Address: 4/1, apt. 108, Mailin Street, Astana, Kazakhstan
Website: https://utasko.com

This privacy policy regarding personal data (hereinafter — the «Privacy Policy») applies to all information that the Administration of the Utasko Service may obtain about a user while using the website https://utasko.com, the personal account at https://cabinet.utasko.com, the associated mobile application, and the API (hereinafter jointly — the «Service»).

The Service Administration respects the privacy of users of its products and services, as well as the provisions of applicable privacy laws, including the Law of the Republic of Kazakhstan «On Personal Data and Their Protection,» Federal Law No. 152-FZ «On Personal Data» for the Russian Federation, and the General Data Protection Regulation (GDPR) for the European Union. This Privacy Policy is governed by the law of the Republic of Kazakhstan; for residents of the Russian Federation, by the law of the Russian Federation; and for residents of the European Economic Area, by the GDPR.

1. BASIC DEFINITIONS

The following terms and definitions are used in this Privacy Policy:

«Utasko Service Administration» (hereinafter — the «Site Administration») — authorized employees who organize and/or carry out the processing of personal data in the Utasko Service, and who determine the purposes of processing personal data, the composition of personal data subject to processing, and the actions (operations) performed with personal data.

«Personal data» — any information relating to an identified or identifiable individual or legal entity that uses the Utasko Service. Personal data includes, among other things, data automatically transmitted to the Utasko Service during use via software installed on the User’s device, including the IP address, information from cookie files, and information about the browser and device.

«Contact and Client Data» — personal data of third parties (first name, last name, position, phone number, e-mail, correspondence, and other information) that the User independently enters into the Utasko Service within the «Contacts,» «Deals,» and «Tasks» modules to keep records of relationships with their clients.

«Processing of personal data» — collection, systematization, accumulation, storage, clarification (updating, modification), use, distribution (including transfer), depersonalization, blocking, and destruction of personal data.

«User (You)» — an individual or legal entity that registers and uses the Utasko Service (as an Organization Administrator or an invited Employee) in the manner regulated by the Site Administration.

«Organization» — the User’s workspace within the Utasko Service, within which records of Tasks, Projects, Deals, and Contacts are kept.

«Employee» — an individual invited by the Organization Administrator to collaborate in the personal account.

2. WHY THE SITE ADMINISTRATION COLLECTS AND PROCESSES DATA

2.1. The Site Administration collects and processes Personal Data for the following reasons:

a) when necessary to perform the agreement with You, in order to provide a fully functional Service, the operation of the personal account, the Task, Project, and Deal management modules, and to provide the corresponding content and services;
b) when necessary to comply with applicable legal obligations;
c) when necessary for the purposes of the legitimate interests of the Site Administration or a third party (for example, the interests of other Users), unless such interests are overridden by Your prevailing legitimate interests and rights;
d) when You have given Your explicit consent to do so.

2.2. These reasons for collecting and processing Personal Data determine and limit the types of Personal Data collected by the Site Administration, the methods of their use, the data retention periods, the persons who have the right to access this data, and the rights and control mechanisms available to You.

2.3. If You enter the personal data of third parties (Employees, Contacts, Clients) into the Utasko Service — into Task, Project, Deal, or Contact records — You must have a lawful basis (the consent of the relevant person or another legal basis, such as performance of a contract with that person) for processing and storing their personal data in the Utasko Service. With respect to such information, You act as an independent data controller, and the Site Administration acts as the technical platform (processor) providing storage and processing of the data on Your instructions. You bear all risks and liability related to the lawfulness of entering such information, and the Site Administration is not liable for any losses or damages incurred as a result of Your entering third-party personal data without a proper legal basis.

3. WHAT DATA THE SITE ADMINISTRATION COLLECTS AND PROCESSES

3.1. Basic account data

The Site Administration may request Your e-mail address, first name, last name, company name, position, mobile phone number, and other necessary information. Your e-mail address serves as the basis for authorization in the Utasko Service. Providing such information is necessary to use the services of the Utasko Service.

3.2. Data entered within the Organization (Tasks, Projects, Deals, Contacts)

In the course of using the Utasko Service, the User independently creates and populates:

Task records (title, description, assignee, deadlines, priority, comments, attached files);
Project records combining related Tasks;
Deal records moving through Pipeline stages, including information on amount, stage, and interaction history;
Contact records — personal data of individuals and legal entities (name, phone, e-mail, position, organization, notes).

This data is processed by the Site Administration solely for the purpose of ensuring the technical operation of the Utasko Service (storage, display, synchronization, report generation) on the instructions of the User — the controller of this data. The Site Administration does not use the content of Tasks, Projects, Deals, and Contacts for any other purposes besides ensuring the operation of the Service, except in cases expressly provided for by this Policy (for example, detecting violations under clause 3.9) or by law.

3.3. Transactions and payment data

To carry out transactions, You must provide the Site Administration with payment data to enable the transaction to be processed. If You use a bank card, You must provide card information (cardholder name, card number, expiration date), which the Site Administration processes and transmits to the payment system operator to enable the transaction to be carried out and to perform anti-fraud checks. Detailed payment and refund procedures are set out in Section 11 of this Policy.

3.4. Other data You explicitly provide

We collect and process Personal Data that You explicitly send to the Site Administration:

information sent through the feedback form or the «Support» section;
information You provide when requesting technical support or purchasing paid Services, including information necessary to process requests using the relevant payment mechanism;
information You provide when participating in surveys, promotions, or questionnaires conducted by the Site Administration.

3.5. Use of the Utasko Service

The Site Administration collects various information when You interact with the Utasko Service: browser and device information, automated electronic interaction data, an event log (actions in the personal account — creating, modifying, deleting Tasks, Deals, and other objects), and data on the use of the application and individual modules (Dashboard, Reports, Pipelines, etc.).

3.6. Tracking data and cookie files

The Site Administration uses cookie files — text files placed on Your device that help analyze how users use the services of the Utasko Service — and similar technologies (web beacons, device identifiers) to recognize You and/or the connection of Your devices. You can configure Your browser settings to prevent the acceptance of cookie files; however, in this case, some of the functionality of the Utasko Service (including saving interface settings) may be unavailable.

The Site Administration’s servers log Your global IP address in the log when You visit the Service.

3.7. Web analytics services

The Utasko Service may use web analytics services (in particular, Google Analytics and Yandex.Metrika) that use cookie files to analyze how visitors use the Utasko Service. Information generated by cookie files is transmitted to and stored on the servers of the relevant analytics operator companies and is not linked by them to other data that personally identifies You. You may disable the use of cookie files in Your browser settings.

3.8. Recommendations and marketing communications

The Site Administration may process collected information to tailor content, pricing offers, and services to Your preferences. With Your consent, the Site Administration may send You marketing messages about Utasko products and services by e-mail. You may withdraw Your consent to receive such messages at any time by following the «Unsubscribe» link included in every marketing message.

3.9. Information necessary to detect violations

The Site Administration collects certain data necessary to detect, investigate, and prevent fraud and other violations of applicable law and the terms of the Utasko Service User Agreement. Such data is stored for the minimum period necessary for these purposes, or for the applicable limitation period if a violation is identified.

4. DATA RETENTION PERIOD

The Site Administration stores Your information only for as long as necessary to achieve the purposes for which such information is collected and processed, or (if the law provides for a longer period) for the retention period required by law. At the end of this period, Your Personal Data is deleted, blocked, or anonymized.

In particular:

If You withdraw Your consent to the processing of Personal Data, the Site Administration deletes such data without undue delay, to the extent that processing is based on the withdrawn consent.
When an Organization, a User account, or individual Tasks, Projects, Deals, and Contacts are deleted, the corresponding data is removed from the active database of the Utasko Service in the manner provided for by the Service’s functionality (taking into account data moved to the Archive and backup copies, which are stored for technical purposes for a limited period).
If You exercise Your right to object to the processing of Personal Data, the Site Administration will, without undue delay, delete the data processed for the purpose to which You object, unless there is another legal basis for its processing and storage.
The Site Administration may store certain transaction data in accordance with legally established commercial and tax rules for a period of up to ten (10) years.

5. WHO HAS ACCESS TO THE DATA

5.1. The Site Administration and its service providers (including payment providers and cloud computing and hosting providers) may grant each other access to Your Personal Data and use it as necessary to achieve the purposes specified in this Policy. In the event of a reorganization, sale, or merger, the Site Administration may transfer Personal Data to the relevant third party in accordance with applicable law.

5.2. Within a single Organization, the data of Tasks, Projects, Deals, and Contacts is accessible to the Organization Administrator and to those Employees who have been granted the corresponding level of access in the personal account settings. The Site Administration does not control and is not responsible for the distribution of access rights within the Organization — this is within the exclusive competence of the Organization Administrator.

5.3. The Site Administration provides Your Personal Data to third-party service providers who provide customer support services in connection with services distributed through the Utasko Service, to the extent necessary to provide such services.

5.4. In accordance with Internet standards, the Site Administration has the right to provide certain technical information (including the IP address) to third-party network service providers that ensure the operation of the content delivery network and servers.

5.5. The Site Administration may disclose Personal Data in accordance with court orders or other binding requirements of authorized bodies.

5.6. The Site Administration may allow You to link Your account to an account offered by a third party (for example, Google). In this case, the use of Your information by such a third party is governed by its own privacy policy, which You are advised to review.

6. YOUR RIGHTS AND CONTROL MECHANISMS

Data protection laws in the Republic of Kazakhstan, the European Economic Area, and other territories grant citizens certain rights with respect to their Personal Data. The Site Administration seeks to ensure these rights are available to its users worldwide.

6.1. Right of access

You have the right to request, free of charge: 1) information on whether Your Personal Data is stored; 2) access to it; and/or 3) a copy of it. This right may be exercised through the personal account of the Utasko Service (the «Profile» section) or by contacting support.

6.2. Right to rectification

If Your Personal Data is inaccurate or incomplete, You may change it in the «Profile» section of the Utasko Service personal account.

6.3. Right to erasure

You have the right to request the deletion of Your Personal Data. As a result of account deletion, You will lose access to the Utasko Service, including the account, subscription, and other information associated with Your account. Deletion of an Organization Administrator’s account may result in the loss of access for all Employees of the Organization to that Organization’s data — it is recommended that You export any necessary data in advance.

6.4. Right to object

If the processing of Your Personal Data is based solely on the legitimate interests of the Site Administration, You have the right to object to such processing. The Site Administration will stop processing unless there are compelling legitimate grounds for continuing it, in particular the need to establish, exercise, or defend legal claims.

You also have the right to lodge a complaint with the authorized supervisory authority for personal data protection.

7. PROCESSING OF CONTACT AND CLIENT DATA ENTERED BY THE USER

7.1. The Utasko Service provides the User with tools (the «Contacts,» «Deals,» and «Tasks» modules) to independently keep records of relationships with their clients, partners, and contractors. Persons whose data is entered by the User into these modules are generally not registered users of the Utasko Service.

7.2. With respect to the personal data it enters into the Utasko Service, the User acts as an independent data controller and is obligated to independently ensure it has a lawful basis for processing such data (including, where necessary, the consent of the relevant individuals), as well as compliance with applicable personal data protection law with respect to its Contacts and Clients, in accordance with clause 6.2.9 of the Utasko Service User Agreement.

7.3. With respect to Contact and Client data, the Site Administration acts as a technical platform (processor) and processes such data solely on the User’s instructions and to the extent necessary to provide the User with the functionality of the Utasko Service, without independently using this data for other purposes.

8. AGE RESTRICTIONS

The minimum age for creating a User account in the Utasko Service is 18 years, since use of the Service involves entering into a public offer, conducting commercial activity, and making payments. The Site Administration is not liable for use of the Utasko Service by persons under the age of 18.

9. LINKS TO OTHER WEBSITES

The Utasko Service may contain links to other websites. A link to a third-party website does not mean that the Site Administration endorses its content or is affiliated with it. You access such third-party websites at Your own risk and should review their privacy policies independently.

10. CHANGES TO THE PRIVACY POLICY

Any changes the Site Administration may make to this Privacy Policy in the future will be published on this page, and in the event of material changes, the Site Administration will notify You through the Utasko Service. It is recommended that You periodically revisit this page to review the current version of the Policy.

11. PAYMENT AND REFUND RULES

11.1. Payment rules

VISA and MasterCard cards are accepted for payment. Online payment is carried out in accordance with the rules of the international payment systems Visa and MasterCard, based on the principles of confidentiality and security of payment, using modern methods of verification, encryption, and data transmission over secure communication channels. Bank card data is entered on a secure payment page.

On the bank card data entry page, You will need to provide the card number, cardholder name, card expiration date, and the three-digit security code (CVV2 for VISA or CVC2 for MasterCard). All required data is indicated on the card itself. After entering the data, You will be redirected to Your bank’s page to confirm the payment with a 3-D Secure code, which will be sent via SMS. If the 3-D Secure code is not received, You should contact the bank that issued the card.

Cases of payment refusal:

the bank card is not intended for online payments — to be verified with the issuing bank;
insufficient funds on the bank card for payment;
the bank card details were entered incorrectly;
the bank card has expired.

For questions regarding payment by bank card and other questions related to the operation of the Utasko Service, You may contact support@superqr.com

The personal information You provide (name, address, phone, e-mail, bank card number) is confidential and shall not be disclosed. Your bank card data is transmitted only in encrypted form and is not stored on the Utasko Service server.

11.2. Refund rules

When paying by bank card, cash refunds are not permitted. The refund procedure is governed by the rules of the relevant international payment systems. The procedure for refunding payment for a service is governed by Article 14 of the Law of the Republic of Kazakhstan «On Protection of Consumer Rights.»

The User has the right to cancel the Service at any time before its actual performance (i.e., before the actual activation of the paid subscription plan).
If the User cancels the Service, the Utasko Service Administration will refund the amount paid, less expenses actually incurred by the Administration, no later than 10 (ten) days from the date the User submits the corresponding request.
To refund funds to a bank card, the User must complete a «Refund Application» (the form is sent upon request to the e-mail address) and send it, together with a copy of an identity document, to support@superqr.com. The refund will be made to the bank card within 21 (twenty-one) business days from the date the Utasko Service Administration receives the said application.
To refund funds for transactions processed in error, a written application must be submitted, together with receipts/invoices confirming the erroneous charge, to support@superqr.com. The refund amount is equal to the amount of the transaction performed. The review period for the application is calculated in business days from the date the application is received by the Utasko Service Administration, excluding public holidays and weekends.

12. CONTACT INFORMATION

You may contact the Site Administration’s data protection officer at the address below. The Site Administration reviews any requests sent by e-mail:

e-mail: support@superqr.com

Details:
MVoter Technologies Limited Liability Partnership
BIN 191040018597
Registered address: 4/1, apt. 108, Mailin Street, Astana, Kazakhstan
IIC KZ77601A871002660921 (KZ)
Bank: Halyk Bank of Kazakhstan JSC
BIC HSBKKKZKX
OKED code 63112
Director: Sadykov Baurzhan Timurovich, acting on the basis of the Charter
Website: https://utasko.com

Publication date: June 1, 2026