Robonexus LLP – Drone delivery service
Version: 25 May 2026 | Republic of Kazakhstan
This Privacy Policy (hereinafter the "Policy") applies to all users of the online resources and services of Robonexus LLP (hereinafter the "Company", "we"). It explains what data we collect, why, how we use it, and what you have the right to request. By using the website or the delivery service, you confirm that you have read this Policy. If you do not agree – please do not use our service.
01Who we are and how to contact us
The Company is the owner and operator of the users' personal data database, determines the purposes of processing, and is responsible for compliance.
Robonexus LLP
250440017198
Almaty, Almalinsky district, Shafik Chokin St., 189, apt. 38
15 business days
02User consent
A user who uses the Company's online resources and services gives consent to the collection and processing of personal data in the manner provided for by this Policy. Consent may be given in writing, in the form of an electronic document, or by any other means allowing its receipt to be confirmed, in accordance with the requirements of the legislation of the Republic of Kazakhstan. The Company retains confirmation of consent in the cases provided for by law. Consent may be withdrawn at any time by sending an enquiry to the contacts listed in Section 1.
03List of data processed
The composition of the data collected depends on the stage at which you interact with our service.
Stage 1 – Landing page and delivery zone check
On your first visit to the website, we collect:
- The delivery address you enter in the coverage zone check field.
- Approximate device coordinates – only if you have allowed the browser to determine your location.
- Technical session data: device and browser type, country of connection, time of visit (via analytics services).
- IP address data – for geolocation for the purpose of checking the delivery zone.
We treat the address and geodata as personal data: in combination with other information, they may make it possible to identify the user.
Stage 2 – Test order
When placing an order, we request:
- Surname, first name, patronymic.
- City of residence.
- Mobile telephone number.
- Email address.
- Delivery address.
- Gender and date of birth, where necessary to provide the service.
- Device information.
In addition, in the course of processing orders the Company may collect:
- Correspondence with the Company via the built-in chat or other communication channels.
- Photographs – only at the user's wish and with their consent, to provide detailed clarification of a request.
- Microphone and camera data – for sending voice messages and photos in the chat (with separate permission).
- Identity verification information: in certain cases the Company may request a copy of an identity document.
We neither receive nor store bank card details – payment data is processed directly by the payment provider.
Stage 3 – Integration with Freedom SuperApp
Upon redirection to or integration with Freedom SuperApp, the data required to complete the order (identifier, address, contact details) is transferred to us. The privacy policy of that service applies to data processed on the Freedom platform. We explicitly inform the user about the transition before the redirect.
04Purposes of data processing
The Company processes personal data solely for specific, predetermined purposes:
- To check whether the user's address falls within the drone delivery zone.
- To place and fulfil an order and to notify of delivery status.
- To enable communication with the user via chat, email, and SMS. The user may opt out of mailings at any time by notifying the Company.
- To resolve disputes, process feedback, and remedy malfunctions.
- To analyse and improve the services and content of the service.
- To analyse geographical demand: we study which districts and cities requests come from in order to plan route expansion. For this purpose the data is aggregated and anonymised – no individual user is identified.
- To verify the user's identity where necessary.
- To compare and check personal data in order to confirm its accuracy.
- To comply with the requirements of the legislation of the Republic of Kazakhstan.
We do not use data for purposes not described in this Policy. If the purposes change we will notify the user before the new processing begins.
05Legal grounds for processing
Personal data is processed on the following grounds:
- User consent – the primary ground for most operations.
- Performance of a contract (order) – processing of data necessary to provide the delivery service.
- Legitimate interest – security analytics and fraud prevention, provided that the user's rights are not infringed.
- Legal requirement – in cases where processing is necessary to comply with legal provisions.
07Geodata and delivery addresses
The delivery address and coordinates are key data for our service. How we handle them:
- The user enters the address voluntarily – to check the coverage zone or to place an order.
- Device geolocation is requested only with the user's explicit permission through the browser.
- IP-based detection is used in the background for an initial assessment of the zone.
- Entered addresses are retained for demand analysis. The data is aggregated by district and neighbourhood – without being linked to an individual user.
To display the map and delivery zones we use third-party mapping services (Google Maps, 2GIS, or equivalents), which operate under their own privacy policies. Addresses from completed orders are retained for the period necessary for support and the resolution of claims (see Section 10 for details).
09Cross-border transfer of data
The Company may carry out cross-border transfers of personal data to foreign states that ensure the protection of personal data. Transfer to states that do not ensure such protection is carried out only with the user's consent or in other cases expressly provided for by the legislation of the Republic of Kazakhstan (Article 16 of the Law "On Personal Data and Its Protection").
Some of our partners (analytics and mapping services) may process data outside the Republic of Kazakhstan. At registration and when placing an order, we explicitly notify the user of this and request consent.
10Retention periods and termination of processing
The Company processes and retains personal data for the period necessary to achieve the purposes of its collection and processing, and in other cases established by the legislation of the Republic of Kazakhstan.
- Data entered when checking the delivery zone (without placing an order): the address linked to the session – no more than 90 days; aggregated data is retained indefinitely in anonymised form.
- Data relating to a placed order – 3 years from the date the service was provided, for support and dispute resolution.
- Analytics cookies – in accordance with the policy of the analytics service, as a rule no more than 26 months.
- After withdrawal of consent – processing ceases within 15 business days, unless otherwise required by law.
The Company takes measures to destroy personal data once the purpose of its collection and processing has been achieved. Upon a user's request, the Company, within the time limits provided for by law:
- amends and/or supplements personal data on the basis of supporting documents, or destroys it where amendment is not possible;
- blocks personal data where there is information about a breach of the conditions of its collection or processing;
- destroys personal data where it is confirmed that it was collected or processed in breach of the law.
11Data security
Users' personal data is stored in the Company's information systems on servers located in the territory of the Republic of Kazakhstan, unless otherwise provided by law.
To protect data from unauthorised access and disclosure, the Company applies:
- Encryption of data transmission (HTTPS).
- Access restriction: only employees who need the data for their work have access to it.
- Access control for affiliated companies, contractors, and partners.
- Protection by means of passwords and other technical measures.
The use, transfer, distribution, anonymisation, blocking, deletion, and destruction of personal data are carried out only on the basis of decisions of authorised representatives of the Company in accordance with the requirements of applicable law. In the event of a security incident, we will notify the authorised body immediately upon its discovery.
12Third parties – a separate case
This Policy concerns exclusively the processing of personal data by the Company itself. If a user discloses their data to other persons (for example, at the request of other users or specialists), different rules may apply to such use and disclosure. The Company recommends that users clarify the purposes of use before providing their personal data to third parties.
13User rights
A user may at any time submit an enquiry on matters relating to the processing of personal data through the Company's communication channels listed in Section 1. As part of such an enquiry, the user has the right to:
- Know about the fact, purposes, sources, and methods of collection and processing of their data, its composition, and retention periods.
- Request amendment or supplementation of their data where supporting documents are available.
- Withdraw consent to the collection, processing, distribution, transfer to third parties, and cross-border transfer of their data.
- Request the blocking of data where there are grounds to believe that the processing breaches the law.
- Request the destruction of data if it was obtained in breach of the law.
- Object to automated processing that affects their rights and legitimate interests.
- Appeal against the actions (or inaction) of the Company in the manner established by the legislation of the Republic of Kazakhstan.
The Company reviews enquiries within 15 business days. To prevent abuse and to process an enquiry correctly, the Company may request an identity document or another document needed to identify the user. If an enquiry is refused – the Company provides a reasoned response.
14Beta – test mode of the service
Data collected during the testing period is also used for:
- Assessing the technical performance of the service.
- Analysing geographical demand and planning routes.
- Fixing errors and improving delivery quality.
If, during testing, we plan to collect additional data (for example, drone route, flight time) – the user will be explicitly notified and their consent will be requested separately. Where integration with Freedom SuperApp takes place via a redirect, the order is placed on the Freedom platform and the privacy policy of that service applies to it. Once beta testing is complete, this Policy will be updated to reflect the final architecture of the service.
15Future integrations
As the service develops, new features are planned: a mobile application, a loyalty programme, and partner integrations with marketplaces. When introducing new features that involve the processing of additional data, the Company will update this Policy and notify users. Features requiring consent will be launched only after it has been obtained.
16Changes to the Policy
The Company continuously improves the ways in which data is collected, stored, and processed, including security measures. For this reason, and in the event of changes to personal data legislation, the Company may amend this Policy at any time, notifying users on the Company's online resources. In the case of material changes, the Company will additionally notify users by email (if provided). Continued use of the service after the changes take effect confirms the user's agreement with the new version, unless separate consent is required by law.
The date of the latest version is always shown at the top of the document.
Other service documents
Terms of Service and the safety guidelines.